strip docker type — site-publish is static-content only

Removes type: docker handling from action.yaml, scripts (build/deploy/utils/setup),
and templates (deployment.yaml.j2, service-docker.yaml.j2). Renamed
service-static.yaml.j2 -> service.yaml.j2.

If site.yaml has type: docker, parse_site_yaml() now dies with a clear message
pointing to action/image-build + action/image-push + action/image-deploy with
hand-authored apps-repo manifests. rainsounds.vino.network was the only docker
consumer and has already migrated.

Drops registry-password input from action.yaml (no longer needed).

action.yaml

@@ -1,24 +1,21 @@
 name: Publish Site
-description: Build and deploy a site (static, hugo, mkdocs, or docker) to fritzlab k8s.
+description: Build and deploy a static-content site (static, hugo, mkdocs) to Garage S3 with Traefik + cert-manager. Containerized apps should use action/image-build + action/image-push + action/image-deploy.
 inputs:
   token:
     description: Gitea token (ci-bot) for apps repo push and API operations
     required: true
   s3-access-key:
-    description: Garage ci-deploy-key access key id (required for static/hugo/mkdocs)
-    required: false
+    description: Garage ci-deploy-key access key id
+    required: true
   s3-secret-key:
-    description: Garage ci-deploy-key secret access key (required for static/hugo/mkdocs)
-    required: false
-  registry-password:
-    description: Container registry password (required for docker type; defaults to token)
-    required: false
+    description: Garage ci-deploy-key secret access key
+    required: true
   s3-endpoint:
     description: Garage S3 endpoint URL
     required: false
     default: http://garage.storage.svc:3900
   garage-admin-token:
-    description: Garage admin API token (required for static/hugo/mkdocs to reconcile bucket aliases)
+    description: Garage admin API token (required only when site.yaml has aliases — used to reconcile bucket globalAliases)
     required: false
   garage-admin-endpoint:
     description: Garage admin API endpoint URL
@@ -43,7 +40,6 @@ runs:
         SITE_DIR: ${{ github.workspace }}
         ACTION_DIR: ${{ github.action_path }}
         GITHUB_RUN_NUMBER: ${{ github.run_number }}
-        REGISTRY_PASSWORD: ${{ inputs.registry-password || inputs.token }}
         CI_BOT_USER: ${{ inputs.username }}
 
     - name: Deploy