Add Django site, Docker packaging, and beta/prod Gitea deploys.

Unignore site/ (was blocked by mkdocs /site rule), add compose/Docker/uv tooling, and split deploys so push to main goes to beta while prod stays manual.

site/social/crypto.py

@@ -0,0 +1,27 @@
+"""Token encryption helpers for SocialAccount."""
+
+from cryptography.fernet import Fernet, InvalidToken
+from django.conf import settings
+
+
+def _fernet() -> Fernet:
+    key = settings.SOCIAL_TOKEN_ENCRYPTION_KEY
+    if not key:
+        # Dev-only fallback — generate is not stable across restarts; set the env var.
+        key = Fernet.generate_key().decode()
+    if isinstance(key, str):
+        key = key.encode()
+    return Fernet(key)
+
+
+def encrypt_tokens(plaintext: str) -> str:
+    return _fernet().encrypt(plaintext.encode()).decode()
+
+
+def decrypt_tokens(ciphertext: str) -> str:
+    if not ciphertext:
+        return ""
+    try:
+        return _fernet().decrypt(ciphertext.encode()).decode()
+    except InvalidToken as exc:
+        raise ValueError("Unable to decrypt social tokens") from exc