Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

README.md

@@ -0,0 +1,63 @@
+# aptly-containerized
+
+[aptly](https://www.aptly.info/) (Debian repository management) as a container image,
+Docker Compose stacks (test + production), and a Helm chart — built so that aptly can
+be **configured through Helm especially easily** and deployed at **any security
+level**, from completely open to fully authenticated.
+
+## What's in here
+
+| | |
+|---|---|
+| `images/aptly-server/` | aptly, cross-compiled from source, non-root, minimal footprint |
+| `images/aptly-deb-builder/` | packaging image: build a `.deb` (nfpm or `dpkg-buildpackage`) and push it, in one step |
+| `compose/` | test stack (one command, wide open) and a production stack (auth, healthchecks, backup) |
+| `charts/aptly/` | Helm chart, aptly-native (no library-chart dependency) |
+| `rootfs/usr/local/bin/` | the scripts shared by both worlds (Compose + Helm) — config rendering, declarative state, push helpers |
+| `action.yaml` | reusable Gitea Action: build + push a package in three lines |
+| `.gitea/workflows/` | CI, independent image/chart releases, weekly CVE rebuild |
+
+## Quickstart
+
+```bash
+docker compose -f compose/docker-compose.test.yaml up -d --build
+curl http://localhost:8080/api/ready
+```
+
+Details and the production path: [docs/quickstart-compose.md](docs/quickstart-compose.md).
+
+```bash
+helm install aptly oci://git.morlana.online/f.weber/aptly --version <version>
+```
+
+Details: [docs/quickstart-helm.md](docs/quickstart-helm.md).
+
+## Docs
+
+- [Security modes](docs/security.md) — the four presets, the Ingress split, the
+  CIDR pitfall, unsigned mode
+- [Packaging & declarative state](docs/packaging.md) — `aptly-pack`/`push`/`release`,
+  the `state.yaml` reference, the prefix-escaping pitfall
+- [Versioning](docs/versioning.md) — tagging and releasing the image and the chart
+  independently
+- [Operations](docs/operations.md) — storage resizing, backup/restore, GPG rotation,
+  runner preflight
+
+## Keeping itself current
+
+`renovate.json` tracks `aptly-dev/aptly`, `mikefarah/yq`, `goreleaser/nfpm`, and the
+base images via PR. `.gitea/workflows/rebuild.yaml` rebuilds weekly (Debian CVEs in
+the base images) even when aptly itself hasn't changed, and reports on itself (a
+Gitea issue) if a run goes missing.
+
+## Verification
+
+```bash
+make lint   # hadolint, shellcheck, helm lint, helm template over every ci/*.yaml
+make test   # tests/smoke-test.sh — pack -> push -> publish -> a real apt-get, the merge gate
+```
+
+## License
+
+MIT, see [LICENSE](LICENSE). Includes/uses aptly, nginx, and nFPM — see
+[NOTICE.md](NOTICE.md).