refactor: move the public host out to vantage-site and vantage-docs

site/ and sitesvc/ become web/ and server/ in vantage-site; docsite/
becomes the root of vantage-docs. Their images move with them, to
vantage/vantage-site/{web,server} and vantage/vantage-docs.

Nothing here imported any of them, and sitesvc turned out to read no
database at all, so both cuts are clean. docker-compose.site.yml is
deleted rather than emptied: every service it held now ships with the
repository that builds it, and deploy/docker/docker-compose.yml is once
again exactly a self-hosted install.

Corrects four comments that named sitesvc for work it no longer does.

.gitea/workflows/server-deploy.yml

@@ -6,8 +6,8 @@ on:
             - main
     # Manual runs rebuild everything: there is no "before" commit to diff
     # against, which the change detection below treats as "build it all". That
-    # is also the escape hatch for a repo VARIABLE change — editing API_URL or
-    # ADMIN_ENV pushes no commit, so nothing would rebuild on its own.
+    # is also the escape hatch for a repo VARIABLE change — editing HQ_URL
+    # pushes no commit, so nothing would rebuild on its own.
     workflow_dispatch:
 
 jobs:
@@ -85,14 +85,13 @@ jobs:
                   # in the same push should not depend on the pin being bumped
                   # in that same push to trigger a rebuild.
                   flag server    '^(server/|proto/|default_steps/|go\.work)'
-                  flag sitesvc   '^(sitesvc/|go\.work)'
 
-                  # The three Next images and the docs site use their own
-                  # directory as the build context, so nothing outside it can
-                  # affect them.
+                  # web/ uses its own directory as the build context, so
+                  # nothing outside it can affect it. It is the only front end
+                  # left here: the marketing site and the docs went to
+                  # vantage-site and vantage-docs, the HQ console to
+                  # vantage-admin.
                   flag web       '^web/'
-                  flag site      '^site/'
-                  flag docsite   '^docsite/'
 
             # vantage-shared is private, so every Go build below needs a
             # credential for it. A netrc is written once here rather than a
@@ -156,33 +155,3 @@ jobs:
                     -f web/Dockerfile web/
                   docker push "$IMAGE"
 
-            - name: Build and push site image
-              if: steps.changed.outputs.site == 'true'
-              run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/site:latest"
-                  docker build \
-                    --build-arg NEXT_PUBLIC_SITE_API="${{ vars.SITE_API_URL }}" \
-                    --build-arg NEXT_PUBLIC_CONTACT_EMAIL="support@hostxtra.co.uk" \
-                    --build-arg NEXT_PUBLIC_ADMIN_API_URL="${{ vars.ADMIN_API_URL }}" \
-                    -t "$IMAGE" \
-                    -f site/Dockerfile site/
-                  docker push "$IMAGE"
-
-            - name: Build and push sitesvc image
-              if: steps.changed.outputs.sitesvc == 'true'
-              run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/sitesvc:latest"
-                  docker build --secret id=netrc,src="$HOME/.netrc" \
-                    -t "$IMAGE" -f sitesvc/Dockerfile sitesvc/
-                  docker push "$IMAGE"
-
-            - name: Build and push docsite image
-              if: steps.changed.outputs.docsite == 'true'
-              run: |
-                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/docsite:latest"
-                  # DOCS_BASE_URL must match the proxy location that routes to
-                  # this container and the directory the image serves from.
-                  docker build \
-                    -t "$IMAGE" \
-                    -f docsite/Dockerfile docsite/
-                  docker push "$IMAGE"