Dockerize scha and wire Gitea CI/CD for server-infra deploy.

Move secrets and DB config to env-driven settings so prod can run on shared Postgres behind deploy.sh, matching company_site.

scripts/docker-entrypoint.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd /app
+
+wait_for_database() {
+  if [[ -z "${DATABASE_URL:-}" && -z "${DB_HOST:-}" ]]; then
+    return 0
+  fi
+
+  echo "Waiting for database..."
+  for _ in $(seq 1 30); do
+    if uv run python - <<'PY'
+import os
+import sys
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "scha.settings")
+
+import django
+from django.db import connections
+from django.db.utils import OperationalError
+
+django.setup()
+
+try:
+    connections["default"].ensure_connection()
+except OperationalError:
+    sys.exit(1)
+PY
+    then
+      echo "Database is ready."
+      return 0
+    fi
+    sleep 2
+  done
+
+  echo "Database did not become ready in time." >&2
+  exit 1
+}
+
+wait_for_database
+
+uv run python manage.py migrate --noinput
+uv run python manage.py collectstatic --noinput
+
+exec uv run gunicorn scha.wsgi:application \
+  --bind "${GUNICORN_BIND:-0.0.0.0:8000}" \
+  --workers "${GUNICORN_WORKERS:-2}"

scripts/validate-env.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${1:?Usage: $0 <env-file>}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Environment file not found: $ENV_FILE" >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+DJANGO_ENV="${DJANGO_ENV:-prod}"
+
+required_vars=(
+  DJANGO_SECRET_KEY
+  DJANGO_ALLOWED_HOSTS
+  DATABASE_URL
+  WEB_PORT
+)
+
+if [[ "$DJANGO_ENV" == "prod" || "$DJANGO_ENV" == "beta" ]]; then
+  required_vars+=(
+    STRIPE_PUBLISHABLE_KEY
+    STRIPE_SECRET_KEY
+    STRIPE_ENDPOINT_SECRET
+    RECAPTCHA_PUBLIC_KEY
+    RECAPTCHA_PRIVATE_KEY
+  )
+fi
+
+missing=()
+for var in "${required_vars[@]}"; do
+  if [[ -z "${!var:-}" ]]; then
+    missing+=("$var")
+  fi
+done
+
+if ((${#missing[@]} > 0)); then
+  echo "Missing required environment variables in $ENV_FILE:" >&2
+  printf '  - %s\n' "${missing[@]}" >&2
+  echo "Copy .env.prod.example to ~/Documents/secrets/scha/scha_${DJANGO_ENV}.env and set production values." >&2
+  exit 1
+fi
+
+if [[ "$DJANGO_ENV" == "prod" && "$DJANGO_SECRET_KEY" == change-me* ]]; then
+  echo "DJANGO_SECRET_KEY must be changed from the example value for production." >&2
+  exit 1
+fi
+
+echo "Environment validation passed (DJANGO_ENV=$DJANGO_ENV)."