Add staging reaper for timetracker branch deployments

Removes timetracker staging containers/volumes/images whose branch no
longer exists on Gitea. Backstop for missed branch-delete events from
the staging workflow in the timetracker repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/staging-reaper.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Removes timetracker staging containers (deployed by .gitea/workflows/staging.yml
+# in the timetracker repo) whose branch no longer exists on Gitea.
+# Backstop for missed branch-delete events; safe to run any time.
+set -euo pipefail
+
+API="https://git.kucharczyk.xyz/api/v1/repos/lukas/timetracker/branches?limit=50"
+
+# If the API is unreachable, set -e aborts here and nothing gets reaped.
+branches=$(curl -fsS "$API" | python3 -c 'import json,sys; print("\n".join(b["name"] for b in json.load(sys.stdin)))')
+
+docker ps -a --filter label=xyz.kucharczyk.staging=timetracker --format '{{.Names}}' | while read -r name; do
+  branch=$(docker inspect "$name" --format '{{ index .Config.Labels "xyz.kucharczyk.staging.branch" }}')
+  if ! grep -qxF "$branch" <<<"$branches"; then
+    image=$(docker inspect "$name" --format '{{ .Config.Image }}')
+    docker rm -f "$name" >/dev/null
+    docker volume rm "$name" >/dev/null 2>&1 || true
+    docker rmi "$image" >/dev/null 2>&1 || true
+    echo "reaped ${name} (branch '${branch}' no longer exists)"
+  fi
+done