ci: run CI only on Forgejo and delete the never-run GitHub workflows (WS-D)

The repository has Forgejo and GitLab remotes but no GitHub remote, so
nothing under .github/workflows ever ran - including the daily Payple
renewal job, which means Payple subscriptions were not being renewed.

- Port payple-renew (daily cron + manual dispatch) to Forgejo. Requires the
  Forgejo secrets SUPABASE_URL and CRON_SECRET.
- Port the CI checks (quality incl. version:check and contract:check, build,
  mobile quality, edge functions, API tests) to .forgejo/workflows/ci.yml.
  macOS and Android emulator jobs are dropped: no macOS runner here, and the
  signed Android release stays on GitLab mobile-production-release.
- Keep one site deploy workflow (Linux, Cloudflare Pages); remove the
  manual Windows duplicate. The mobile release boundary self-test runs there.
- Release verifiers read the Forgejo/GitLab workflows, fail if .github
  workflows come back, and check the rewritten site offers no mobile package.

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-7 and W3-8.

.forgejo/workflows/deploy-site.yml

@@ -1,5 +1,14 @@
 name: deploy-site
 
+# 사이트(site/) 배포의 유일한 경로: Cloudflare Pages `d3ro` (d3ro.chanpaca.net).
+# 예전 deploy-site-windows.yml(수동 전용·배포 검증 없음)과 .github/workflows/deploy-site.yml
+# (GitHub Pages, 실행된 적 없음)을 이 파일로 합쳤다.
+#
+# site/는 저장소 루트의 packages/core/src/*.ts 를 상대 import 하므로 전체 트리를 체크아웃한다
+# (sparse checkout 금지).
+#
+# 필요한 시크릿: CF_API_TOKEN(또는 CLOUDFLARE_API_TOKEN), CF_ACCOUNT_ID(또는 CLOUDFLARE_ACCOUNT_ID)
+
 on:
   push:
     branches: [main]
@@ -21,6 +30,9 @@ jobs:
           git checkout -q -f FETCH_HEAD
           git clean -qfdx
 
+      - name: 모바일 릴리스 공개 경계 검사
+        run: node scripts/ci/verify-mobile-release-boundary.mjs --self-test
+
       - name: 의존성 설치 및 사이트 빌드
         run: |
           npm ci --prefix site