Fix Gitea Actions CI for act_runner on homelab.

Remove Python job containers so checkout@v4 can run (needs Node), install deps on ubuntu-latest for security-scan, and stop excluding README.md from Docker build context.

.dockerignore

@@ -45,7 +45,6 @@ logs/
 .DS_Store
 Thumbs.db
 
-# Docs (optional - include if you want them in container)
+# Docs (keep README.md — required by pyproject.toml / Docker build)
 docs/
-*.md
 

.github/workflows/ci.yml

@@ -9,9 +9,8 @@ on:
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
-    container:
-      image: python:3.11-bullseye
-    
+    # No job container: actions/checkout@v4 needs Node (act_runner fails in python-only images)
+
     services:
       postgres:
         image: postgres:15
@@ -31,8 +30,8 @@ jobs:
 
       - name: Install system dependencies
         run: |
-          apt-get update
-          apt-get install -y postgresql-client
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client python3.11 python3.11-venv python3-pip
 
       - name: Install Python dependencies
         run: |
@@ -70,27 +69,25 @@ jobs:
 
   security-scan:
     runs-on: ubuntu-latest
-    container:
-      image: python:3.11-bullseye
     steps:
       - name: Check out code
         uses: actions/checkout@v4
 
       - name: Install dependencies
         run: |
-          pip install --upgrade pip
-          pip install safety bandit
+          python3.11 -m pip install --upgrade pip
+          python3.11 -m pip install safety bandit
 
       - name: Run safety check
         run: |
-          pip install -e .
-          safety check --json || true
+          python3.11 -m pip install -e .
+          python3.11 -m safety check --json || true
         continue-on-error: true
 
       - name: Run bandit security scan
         run: |
-          bandit -r src/ -f json -o bandit-report.json || true
-          bandit -r src/ -f screen
+          python3.11 -m bandit -r src/ -f json -o bandit-report.json || true
+          python3.11 -m bandit -r src/ -f screen
         continue-on-error: true
 
   dependency-scan: