ci: move the CI to Gitea Actions and cache what is rebuilt

Linux-only runner, so the Windows and macOS legs and GitHub's audit action are
gone. The Rust toolchain, cargo registry and target directories live on the
runner's persistent toolcache volume. release.yml stays under .github and is
not run by Gitea.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verificar:
+    name: Lint, design e build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # O Puppeteer só é usado em scripts locais (slides, capturas); não precisa do Chrome na CI.
+      PUPPETEER_SKIP_DOWNLOAD: "true"
+      NEXT_TELEMETRY_DISABLED: "1"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      # Next.js guarda aqui o resultado da compilação anterior; sem isso, cada
+      # execução recompila todas as páginas do zero.
+      - name: Cache de build do Next
+        uses: actions/cache@v4
+        with:
+          path: .next/cache
+          key: next-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('app/**', 'components/**', 'lib/**') }}
+          restore-keys: |
+            next-${{ runner.arch }}-${{ hashFiles('package-lock.json') }}-
+            next-${{ runner.arch }}-
+
+      - run: npm ci
+
+      # eslint + auditoria do design system (tokens, contraste AAA) + auditoria de páginas
+      - run: npm run check
+
+      - run: npm run build