ci: run CI only on Forgejo and delete the never-run GitHub workflows (WS-D)

The repository has Forgejo and GitLab remotes but no GitHub remote, so
nothing under .github/workflows ever ran - including the daily Payple
renewal job, which means Payple subscriptions were not being renewed.

- Port payple-renew (daily cron + manual dispatch) to Forgejo. Requires the
  Forgejo secrets SUPABASE_URL and CRON_SECRET.
- Port the CI checks (quality incl. version:check and contract:check, build,
  mobile quality, edge functions, API tests) to .forgejo/workflows/ci.yml.
  macOS and Android emulator jobs are dropped: no macOS runner here, and the
  signed Android release stays on GitLab mobile-production-release.
- Keep one site deploy workflow (Linux, Cloudflare Pages); remove the
  manual Windows duplicate. The mobile release boundary self-test runs there.
- Release verifiers read the Forgejo/GitLab workflows, fail if .github
  workflows come back, and check the rewritten site offers no mobile package.

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-7 and W3-8.

.forgejo/workflows/ci.yml

@@ -0,0 +1,188 @@
+name: ci
+
+# 브랜치·PR 검증. 예전 .github/workflows/ci.yml(GitHub 원격이 없어 한 번도 실행되지 않음)에서
+# 자체 호스팅 linux-builder 러너로 돌릴 수 있는 잡만 옮겼다.
+#
+# 옮기지 않은 잡:
+#   - test-matrix의 windows/macos 칸: macOS 러너가 없고, windows 러너는 태그 릴리스 전용으로 둔다.
+#   - mobile-android APK 빌드 / mobile-emulator-e2e: Android SDK + KVM 에뮬레이터가 필요하다.
+#     GitLab 미러(.gitlab-ci.yml mobile-android, mobile-emulator-e2e)가 계속 담당한다.
+#
+# 러너 관례: actions/checkout·setup-* 없이 github.token으로 직접 fetch 한다(다른 .forgejo 워크플로와 동일).
+# Deno/.NET은 scripts/ci/bootstrap-linux-toolchain.sh 가 체크섬 검증 후 설치한다.
+# git clean -fdx 로 지워지지 않도록 도구 캐시는 체크아웃 밖(CI_PROJECT_DIR)에 둔다.
+#
+# 필요한 시크릿: 없음 (github.token 만 사용)
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - "feature/**"
+      - "fix/**"
+  pull_request:
+    branches:
+      - main
+      - develop
+  workflow_dispatch:
+
+jobs:
+  quality:
+    name: 정본·보안·린트·타입·테스트
+    runs-on: linux-builder
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
+          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          [ -d .git ] || git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$url"
+          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: 도구 버전
+        run: |
+          echo "node $(node --version) (.nvmrc $(cat .nvmrc)) / npm $(npm --version)"
+
+      - name: 의존성 설치
+        run: npm ci
+
+      - name: 버전·계약 정본 대조
+        run: |
+          npm run version:check
+          npm run contract:check
+          npm run release:metadata:test
+
+      - name: 하드코딩 자격증명 검사
+        run: |
+          npm run security:secrets:test
+          npm run security:secrets
+
+      - name: 모바일 릴리스 경계·설정 계약
+        run: |
+          npm run release:mobile:boundary:test
+          npm run release:mobile:config:test
+          npm run release:mobile:build-config:test
+          npm run release:play:assets
+
+      - name: 린트
+        run: npm run lint
+
+      - name: 타입 검사
+        run: npm run typecheck
+
+      - name: 테스트 (Vitest)
+        run: npm test
+
+  build-validation:
+    name: 워크스페이스 빌드 검증
+    needs: quality
+    runs-on: linux-builder
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
+          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          [ -d .git ] || git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$url"
+          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: 의존성 설치
+        run: npm ci
+
+      - name: 데스크톱 번들 빌드 + 렌더러 번들 검증
+        run: |
+          npm run build --workspace=@d3ro/desktop
+          node scripts/ci/verify-desktop-renderer-bundles.mjs
+
+      - name: 어드민 빌드
+        run: npm run build --workspace=@d3ro/admin
+
+  mobile-quality:
+    name: 모바일 린트·타입·Jest
+    runs-on: linux-builder
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
+          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          [ -d .git ] || git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$url"
+          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: 의존성 설치
+        run: |
+          npm ci
+          npm --prefix apps/mobile-rn ci --workspaces=false
+
+      - name: 모바일 검사
+        run: |
+          npm --prefix apps/mobile-rn run lint
+          npm --prefix apps/mobile-rn run typecheck
+          npm --prefix apps/mobile-rn run test:ci
+
+  edge-functions:
+    name: Supabase Edge Functions + Cloudflare Worker
+    runs-on: linux-builder
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
+          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          [ -d .git ] || git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$url"
+          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: Deno 2.8.1 설치 후 검사·테스트
+        shell: bash
+        run: |
+          set -euo pipefail
+          export CI_PROJECT_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/d3ro-ci"
+          . scripts/ci/bootstrap-linux-toolchain.sh deno
+          for entrypoint in server/supabase/functions/*/index.ts; do
+            deno check --config server/supabase/functions/deno.json "$entrypoint"
+          done
+          deno test --config server/supabase/functions/deno.json --allow-read --allow-env server/supabase/functions
+          deno check --no-config server/cloudflare-worker/src/push-drain.ts
+          deno test --no-config --allow-read server/cloudflare-worker/src/push-drain.test.ts
+
+  api-server-tests:
+    name: .NET API 서버 테스트
+    runs-on: linux-builder
+    steps:
+      - name: checkout
+        env: { CI_TOKEN: "${{ github.token }}" }
+        run: |
+          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
+          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          [ -d .git ] || git init -q .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin "$url"
+          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q -f FETCH_HEAD
+          git clean -qfdx
+
+      - name: .NET 10.0.302 설치 후 테스트
+        shell: bash
+        run: |
+          set -euo pipefail
+          export CI_PROJECT_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/d3ro-ci"
+          . scripts/ci/bootstrap-linux-toolchain.sh dotnet
+          dotnet restore apps/api-server.Tests/D3ROVoice.Api.Tests.csproj
+          dotnet test apps/api-server.Tests/D3ROVoice.Api.Tests.csproj --configuration Release --no-restore -p:StaticWebAssetsEnabled=false

.forgejo/workflows/deploy-site-windows.yml

@@ -1,34 +0,0 @@
-name: deploy-site-windows
-
-on:
-  workflow_dispatch:
-
-jobs:
-  deploy-win:
-    runs-on: windows
-    defaults: { run: { shell: pwsh } }
-    steps:
-      - name: checkout
-        env: { CI_TOKEN: "${{ github.token }}" }
-        run: |
-          $u = [Uri]$env:GITHUB_SERVER_URL
-          $url = "$($u.Scheme)://actions:$($env:CI_TOKEN)@$($u.Authority)/$($env:GITHUB_REPOSITORY).git"
-          if (-not (Test-Path .git)) { git init -q . }
-          if (git remote | Select-String -Quiet '^origin$') { git remote set-url origin $url } else { git remote add origin $url }
-          git fetch -q --depth 1 origin $env:GITHUB_REF
-          git checkout -q -f FETCH_HEAD
-          git clean -qfdx
-
-      - name: 사이트 빌드
-        run: |
-          npm ci --prefix site
-          npm run build --prefix site
-
-      - name: Cloudflare Pages 배포
-        env:
-          CLOUDFLARE_API_TOKEN: "${{ secrets.CF_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}"
-          CLOUDFLARE_ACCOUNT_ID: "${{ secrets.CF_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}"
-        run: |
-          if ($env:CLOUDFLARE_API_TOKEN) {
-            npx --yes wrangler@latest pages deploy site/dist --project-name d3ro --branch main --commit-dirty=true
-          }

.forgejo/workflows/deploy-site.yml

@@ -1,5 +1,14 @@
 name: deploy-site
 
+# 사이트(site/) 배포의 유일한 경로: Cloudflare Pages `d3ro` (d3ro.chanpaca.net).
+# 예전 deploy-site-windows.yml(수동 전용·배포 검증 없음)과 .github/workflows/deploy-site.yml
+# (GitHub Pages, 실행된 적 없음)을 이 파일로 합쳤다.
+#
+# site/는 저장소 루트의 packages/core/src/*.ts 를 상대 import 하므로 전체 트리를 체크아웃한다
+# (sparse checkout 금지).
+#
+# 필요한 시크릿: CF_API_TOKEN(또는 CLOUDFLARE_API_TOKEN), CF_ACCOUNT_ID(또는 CLOUDFLARE_ACCOUNT_ID)
+
 on:
   push:
     branches: [main]
@@ -21,6 +30,9 @@ jobs:
           git checkout -q -f FETCH_HEAD
           git clean -qfdx
 
+      - name: 모바일 릴리스 공개 경계 검사
+        run: node scripts/ci/verify-mobile-release-boundary.mjs --self-test
+
       - name: 의존성 설치 및 사이트 빌드
         run: |
           npm ci --prefix site

.forgejo/workflows/payple-renew.yml

@@ -0,0 +1,47 @@
+name: payple-renew
+
+# Payple 정기결제 자동 갱신 트리거. 매일 한 번 Supabase Edge Function `payple-renew`를 호출한다.
+# 예전 .github/workflows/payple-renew.yml은 GitHub 원격이 없어 한 번도 실행되지 않았다.
+#
+# 주의:
+#   - Forgejo schedule은 기본 브랜치(main)에 이 파일이 있을 때만 등록된다.
+#   - cron 시각은 Forgejo 서버 기준으로 해석된다. 서버가 UTC면 01:00 UTC = 10:00 KST.
+#
+# 필요한 시크릿:
+#   SUPABASE_URL  — https://<project-ref>.supabase.co (끝 슬래시 없이)
+#   CRON_SECRET   — Supabase Function 시크릿 CRON_SECRET 과 같은 값
+
+on:
+  schedule:
+    - cron: "0 1 * * *"
+  workflow_dispatch:
+
+jobs:
+  renew:
+    runs-on: linux-builder
+    steps:
+      - name: payple-renew Edge Function 호출
+        env:
+          SUPABASE_URL: "${{ secrets.SUPABASE_URL }}"
+          CRON_SECRET: "${{ secrets.CRON_SECRET }}"
+        run: |
+          set -eu
+          if [ -z "${SUPABASE_URL:-}" ] || [ -z "${CRON_SECRET:-}" ]; then
+            echo "SUPABASE_URL / CRON_SECRET 시크릿이 없습니다." >&2
+            exit 1
+          fi
+          response=$(curl --silent --show-error --max-time 300 -w "\n%{http_code}" -X POST \
+            "${SUPABASE_URL%/}/functions/v1/payple-renew" \
+            -H "Authorization: Bearer ${CRON_SECRET}" \
+            -H "Content-Type: application/json")
+
+          http_code=$(printf '%s\n' "$response" | tail -n 1)
+          body=$(printf '%s\n' "$response" | sed '$d')
+
+          echo "HTTP $http_code"
+          printf '%s\n' "$body" | jq . 2>/dev/null || printf '%s\n' "$body"
+
+          if [ "$http_code" -ge 400 ]; then
+            echo "갱신 실패: HTTP $http_code" >&2
+            exit 1
+          fi

.forgejo/workflows/release.yml

@@ -1,9 +1,8 @@
 name: release
 
 # Canonical tag-triggered desktop release built and published on Forgejo.
-# GitLab CI (.gitlab-ci.yml) and GitHub Actions (.github/workflows/release.yml)
-# remain alternate builders; all three converge on publish-forgejo-release.mjs
-# so the Forgejo feed is the single update source.
+# GitLab CI (.gitlab-ci.yml) is the legacy mirror builder; both converge on
+# publish-forgejo-release.mjs so the Forgejo feed is the single update source.
 #
 # Required repository secrets:
 #   FORGEJO_TOKEN              — PAT with write:package + write:repository