feat: refactored docs structure

.github/workflows/deploy.yml

@@ -5,19 +5,53 @@ on:
     branches: [main]
   workflow_dispatch:
 
-# The Worker only. The docs site is built and published from prdlk/cs, which
-# reads docs/ from this repo over HTTP (Blume's mdxRemote()), so this repo has
-# no Pages build.
 permissions:
   contents: read
+  pages: write
+  id-token: write
 
 # The Worker deploy is idempotent (wrangler uploads the whole bundle), so on a
-# burst of pushes only the last one matters: cancel-in-progress is correct.
+# burst of pushes only the last one matters: cancel-in-progress is correct for
+# both the Pages build and the Worker job.
 concurrency:
   group: deploy
   cancel-in-progress: true
 
 jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22 # Blume requires 22.12+
+
+      - uses: oven-sh/setup-bun@v2 # skip if you use npm/pnpm
+
+      - run: bun install --frozen-lockfile
+      # pages/changelog.astro reads this repo's GitHub releases at build time
+      # (apps/docs/lib/releases.ts). The token authenticates that fetch —
+      # required if the repo is private, and it lifts the shared runner's
+      # unauthenticated API rate limit. `contents: read` covers it.
+      - run: bun run build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: apps/docs/dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4
+
   # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
   # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
   # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),