Merge remote-tracking branch 'origin/main' into feat/crawler-system-chromium

Skips the chromiumoxide fetcher when CRAWLER_CHROMIUM_BINARY is set,
unblocking Linux_arm64 deployments (Raspberry Pi 5) where the
fetcher's upstream snapshot bucket has no reliable build. The
Dockerfile gains an INSTALL_CHROMIUM build-arg that adds
chromium-headless-shell + fonts-liberation to the runtime image when
set; default off so cloud/x86 images stay slim.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   test-backend:
     runs-on: ubuntu-latest
+    container:
+      image: rust:1-slim
     services:
       postgres:
         image: postgres:16-alpine
@@ -26,18 +28,10 @@ jobs:
       DATABASE_URL: postgres://mangalord:mangalord@postgres:5432/mangalord
     steps:
       - uses: actions/checkout@v4
-      # ubuntu-latest has node (so JS actions like checkout/cache run) but no
-      # Rust. We intentionally avoid `container: rust:1-slim` because act_runner
-      # runs JS actions with node *inside* the job container, and the slim Rust
-      # image ships no node (checkout would fail with exit 127).
-      - name: Install Rust + build deps
+      - name: Install build deps
         run: |
-          set -eu
-          SUDO=""; [ "$(id -u)" = "0" ] || SUDO="sudo"
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates curl
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          apt-get update
+          apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates
       - name: Cache cargo registry and target
         uses: actions/cache@v4
         with: