v1 dropped node:20-bookworm for a Node-free Debian base, on the wrong
assumption that nothing in CI needs Node since the frontend is Go now.
Forgejo's runner executes actions/checkout@v4 as `node dist/index.js`
inside the job container regardless of what the workflow itself runs,
so every job's checkout step failed. Caught from the live run within
a minute; runner was reverted to node:20-bookworm immediately.
v2 keeps the node:20-bookworm base and only adds docker-ce-cli +
docker-buildx-plugin on top, preserving the actual fix (BuildKit
instead of the classic builder, no per-job docker.io install) without
removing a hard dependency.
docker-stack.yml previously had no cpu/memory limits on db or forgejo,
unlike every service in the app stack. Add generous limits (several
times observed steady-state usage) as a backstop, overridable via env
vars matching the app stack's convention.
Also add ci-runner/Dockerfile: a slim Debian base with the Docker CLI
+ buildx preinstalled, replacing node:20-bookworm (leftover from when
the frontend was Python/Jinja; nothing in CI uses npm/node anymore).
Closes a COPY --chown group-resolution bug in the classic Docker
builder that apt-get install docker.io currently pulls in on every
build-push job, and drops that install step's cost once cut over.
Built and verified locally; not yet pushed to the registry (needs a
write:package-scoped token) or wired into the live runner.
