feat(ci): CI/CD container delivery for ClickOnce artifacts

Replace direct SSH rsync with build → push to registry → Coolify pull pattern,
matching the rest of the infra (decisions-court, ai-gateway, ...). Adds cdn/
Dockerfile + nginx.conf to serve .vsto/.application/.manifest/.deploy with
correct MIME types behind a StripPrefix Traefik middleware.

The new workflow has three jobs:
- build:               Windows runner, nuget restore + msbuild + dotnet test.
- publish-clickonce:   Windows runner, only on v* tag — sign assemblies +
                       mage manifests + upload publish/ as artifact.
- dockerize-and-deploy: Linux runner — download artifact, build & push
                       outlook-addin-cdn:<version> + :latest to
                       gitea.dev.marcus-law.co.il, then trigger Coolify
                       redeploy of app awdlvjlozz0dvn6kjlme9rd7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cdn/Dockerfile

@@ -0,0 +1,24 @@
+# outlook-addin-cdn — serves ClickOnce artifacts at platform.dev.marcus-law.co.il/outlook-addin/*
+#
+# The publish/ directory (produced by the Windows job) is copied into the image
+# along with a custom nginx.conf that maps the ClickOnce-specific MIME types.
+# Each release tag produces a versioned image (e.g. :v1.0.0) + :latest.
+
+FROM nginx:1.27-alpine
+
+# Drop the default site config; our nginx.conf is the only one.
+RUN rm -f /etc/nginx/conf.d/default.conf
+
+COPY nginx.conf /etc/nginx/conf.d/outlook-addin.conf
+# Coolify adds a StripPrefix middleware for the /outlook-addin path, so nginx
+# sees requests at the root (/OutlookAddin.vsto, etc) -- copy files to the
+# nginx root accordingly.
+COPY publish/   /usr/share/nginx/html/
+
+# nginx runs as non-root by default in the alpine image; ensure files readable.
+RUN chmod -R a+rX /usr/share/nginx/html
+
+EXPOSE 80
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD wget -qO- http://localhost/health || exit 1

cdn/nginx.conf

@@ -0,0 +1,44 @@
+# nginx config for outlook-addin-cdn.
+#
+# Routing model: Traefik forwards requests to platform.dev.marcus-law.co.il/outlook-addin/*
+# and Coolify adds a StripPrefix middleware that strips /outlook-addin. nginx
+# therefore sees requests at the root path (e.g. /OutlookAddin.vsto).
+
+server {
+    listen      80 default_server;
+    server_name _;
+
+    root  /usr/share/nginx/html;
+    index index.html;
+
+    # ClickOnce MIME types. Without these, .vsto/.application/.manifest/.deploy
+    # are served as text/plain and the bootstrapper refuses to install.
+    types {
+        application/x-ms-application    application;
+        application/x-ms-manifest       manifest;
+        application/octet-stream        vsto;
+        application/octet-stream        deploy;
+    }
+
+    # ClickOnce checks for updates on every Outlook start; never serve stale
+    # manifests from caches.
+    add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+    add_header Pragma        "no-cache"                              always;
+    add_header Expires       "0"                                     always;
+
+    # Health endpoint for Coolify/Docker healthcheck (path is checked before
+    # StripPrefix since the healthcheck runs inside the container on port 80).
+    location = /health {
+        access_log off;
+        return 200 "ok";
+        add_header Content-Type text/plain;
+    }
+
+    # Never list directories -- that would expose the internal Application Files
+    # layout to anyone browsing.
+    autoindex off;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}