Add CV/resume web app at cv.ops.eblu.me (#169)

## Summary
- nginx container (`containers/cv/`) downloads and serves a content tarball at startup (same pattern as quartz)
- ArgoCD app + k8s manifests (deployment, service, Tailscale ingress)
- Caddy route for `cv.ops.eblu.me`
- Deploy workflow: resolves "latest" or specific version from Forgejo packages, updates deployment, syncs ArgoCD
- Content is built and released from the separate [cv repo](https://forge.ops.eblu.me/eblume/cv)

## Deployment steps (after merge)
1. `mise run container-tag-and-release cv v1.0.0`
2. Run "Release CV" workflow in cv repo (SPECIFIC_VERSION `v0.1.0`)
3. Run "Deploy CV" workflow in blumeops (default: latest)
4. `mise run provision-indri -- --tags caddy`
5. Verify at `https://cv.ops.eblu.me/`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/169

containers/cv/Dockerfile

@@ -0,0 +1,21 @@
+# CV/Resume Static Site Server
+# Downloads and serves a CV site tarball (HTML+CSS+PDF) via nginx
+#
+# Configuration (via environment):
+#   CV_RELEASE_URL - URL to download the CV content tarball
+#
+# The container downloads the tarball on startup, extracts it, and serves with nginx.
+
+FROM nginx:alpine
+
+# Install curl for downloading release assets
+RUN apk add --no-cache curl
+
+# Copy startup script and nginx config
+COPY start.sh /start.sh
+COPY default.conf /etc/nginx/conf.d/default.conf
+RUN chmod +x /start.sh
+
+EXPOSE 80
+
+CMD ["/start.sh"]

containers/cv/default.conf

@@ -0,0 +1,33 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Enable gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript;
+
+    # Cache static assets
+    location ~* \.(css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Force PDF download
+    location = /resume.pdf {
+        add_header Content-Disposition 'attachment; filename="erich-blume-resume.pdf"';
+    }
+
+    # Serve files directly
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    # Health check endpoint
+    location /healthz {
+        access_log off;
+        return 200 "ok\n";
+        add_header Content-Type text/plain;
+    }
+}

containers/cv/start.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+set -e
+
+HTML_DIR="/usr/share/nginx/html"
+
+# Check for required environment variable
+if [ -z "$CV_RELEASE_URL" ]; then
+    echo "Error: CV_RELEASE_URL environment variable is required"
+    echo "Set it to the URL of the CV content tarball to serve"
+    exit 1
+fi
+
+echo "Downloading CV content from: $CV_RELEASE_URL"
+
+# Download the tarball
+if ! curl -fsSL "$CV_RELEASE_URL" -o /tmp/cv.tar.gz; then
+    echo "Error: Failed to download CV content from $CV_RELEASE_URL"
+    exit 1
+fi
+
+# Clear existing content and extract
+rm -rf "${HTML_DIR:?}"/*
+echo "Extracting CV content to $HTML_DIR"
+tar -xzf /tmp/cv.tar.gz -C "$HTML_DIR"
+rm /tmp/cv.tar.gz
+
+echo "CV content extracted successfully"
+echo "Starting nginx..."
+
+# Start nginx in foreground
+exec nginx -g "daemon off;"