Add devel/staging staged-publishing flow, rename default branch to main

- .gitea/workflows/build-deploy.yml: trigger on [main, staging, devel];
  build step picks publishconf.py (main) / stagingconf.py (staging) /
  bare pelicanconf.py (devel, same as a plain local build); deploy
  step already had prod-vs-test branching, updated its ref check from
  master to main to match the repo's renamed default branch.
- stagingconf.py: new, prod-like preview config (feeds, absolute URLs)
  pointed at the internal dev webserver instead of the real domain.
- pelicanconf.py: SITEURL set to the dev webserver address (was ''),
  used by both stagingconf.py and bare devel builds.

.gitea/workflows/build-deploy.yml

@@ -2,7 +2,7 @@ name: Build and deploy
 
 on:
   push:
-    branches: [master]
+    branches: [main, staging, devel]
   workflow_dispatch: {}
 
 jobs:
@@ -27,12 +27,23 @@ jobs:
         # directly from a known_hosts file that already trusts both hosts)
         # rather than fetched via ssh-keyscan — no extra network calls, no
         # TOFU, and no risk of tripping aquaria's connection-rate limiting.
+        # KNOWN_HOSTS is shared between prod/test (just more lines in the
+        # same blob); the deploy key itself picks PROD_/TEST_ by branch,
+        # each falling back to the generic DEPLOY_SSH_KEY if unset.
         env:
+          REF_NAME: ${{ github.ref_name }}
+          PROD_DEPLOY_SSH_KEY: ${{ secrets.PROD_DEPLOY_SSH_KEY }}
+          TEST_DEPLOY_SSH_KEY: ${{ secrets.TEST_DEPLOY_SSH_KEY }}
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
           KNOWN_HOSTS: ${{ vars.KNOWN_HOSTS }}
         run: |
+          if [ "$REF_NAME" = "main" ]; then
+            KEY="${PROD_DEPLOY_SSH_KEY:-$DEPLOY_SSH_KEY}"
+          else
+            KEY="${TEST_DEPLOY_SSH_KEY:-$DEPLOY_SSH_KEY}"
+          fi
           mkdir -p ~/.ssh
-          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
+          printf '%s\n' "$KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           printf '%s\n' "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
 
@@ -45,15 +56,50 @@ jobs:
         run: pip install --no-cache-dir -r requirements.txt
 
       - name: Build site
-        run: pelican -s publishconf.py
+        # main -> real prod config; staging -> prod-like preview (feeds,
+        # absolute URLs) pointed at the dev webserver; devel (or anything
+        # else) -> bare pelicanconf.py, same as a plain local build.
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          if [ "$REF_NAME" = "main" ]; then
+            pelican -s publishconf.py
+          elif [ "$REF_NAME" = "staging" ]; then
+            pelican -s stagingconf.py
+          else
+            pelican
+          fi
 
       - name: Deploy via rsync
+        # main -> production, anything else (i.e. devel/staging) -> test. Host is
+        # required per-target (no generic fallback); port/path/user each
+        # fall back to a shared generic var/secret, then (port only) 22.
         env:
-          DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
+          REF_NAME: ${{ github.ref_name }}
+          PROD_DEPLOY_HOST: ${{ vars.PROD_DEPLOY_HOST }}
+          TEST_DEPLOY_HOST: ${{ vars.TEST_DEPLOY_HOST }}
+          PROD_DEPLOY_PORT: ${{ vars.PROD_DEPLOY_PORT }}
+          TEST_DEPLOY_PORT: ${{ vars.TEST_DEPLOY_PORT }}
           DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
+          TEST_DEPLOY_PATH: ${{ vars.TEST_DEPLOY_PATH }}
           DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
+          PROD_DEPLOY_USER: ${{ secrets.PROD_DEPLOY_USER }}
+          TEST_DEPLOY_USER: ${{ secrets.TEST_DEPLOY_USER }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
         run: |
+          if [ "$REF_NAME" = "main" ]; then
+            HOST="$PROD_DEPLOY_HOST"
+            PORT="${PROD_DEPLOY_PORT:-$DEPLOY_PORT}"
+            DPATH="${PROD_DEPLOY_PATH:-$DEPLOY_PATH}"
+            USER_="${PROD_DEPLOY_USER:-$DEPLOY_USER}"
+          else
+            HOST="$TEST_DEPLOY_HOST"
+            PORT="${TEST_DEPLOY_PORT:-$DEPLOY_PORT}"
+            DPATH="${TEST_DEPLOY_PATH:-$DEPLOY_PATH}"
+            USER_="${TEST_DEPLOY_USER:-$DEPLOY_USER}"
+          fi
+          echo "Deploying $REF_NAME -> $HOST"
           rsync -avz --delete \
-            -e "ssh -4 -i ~/.ssh/deploy_key -p ${DEPLOY_PORT:-22} -o StrictHostKeyChecking=yes" \
-            output/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"
+            -e "ssh -4 -i ~/.ssh/deploy_key -p ${PORT:-22} -o StrictHostKeyChecking=yes" \
+            output/ "${USER_}@${HOST}:${DPATH}"