chore(ci): docs build CI workflow (REQ-032, D-046, D-051, G-016)

Add .gitea/workflows/docs-build.yml: on push, go-test job runs go test ./...
(lexicon firewall + all x/* tests), then docs-build job (needs: go-test per
G-016 firewall-gates-docs-build) installs mkdocs + mkdocs-material, runs
mkdocs build, uploads site/ as a CI artifact. go.mod unchanged (Python deps
isolated to the docs-build job; G-006 intact). Full Gitea Pages publishing
deferred per D-051 (no hosting target configured).

.gitignore: add site/ (mkdocs build output; never committed).

Verification: YAML parses; docs-build needs go-test; go test ./... green;
go.mod unchanged; local mkdocs build succeeds (site/ produced).

---ci---
project: oy
phase: 3
milestone: v0.4
status: execute
tag_base: v0.3.x
milestone_type: nfr
reqs: [REQ-032]
---/ci---

.gitignore

@@ -2,3 +2,5 @@
 .env.secrets
 .env.*
 .ciagent/.env.secrets
+# MkDocs build output (REQ-032 CI produces site/ as an artifact; never commit it)
+site/