Harden staging and bring GitHub/Gitea CI to parity

Address issue #20 and the CI divergence between Gitea and GitHub.

Issue #20 (staging seeded from a prod snapshot):
- Read SECRET_KEY from the environment with the insecure dev key as
  fallback, so each deployment can have its own key.
- Add a `scrub_staging` management command that clears django_session and
  the django-q schedule/queue/results, removing copied prod sessions and
  the inherited convert_prices() schedule.
- Run the scrub from entrypoint.sh when STAGING=true, and wire STAGING plus
  a per-branch SECRET_KEY into the Gitea staging deploy.

CI parity (both systems kept, independent):
- Add the Node/pnpm/TypeScript build steps to the Gitea build workflow to
  match the GitHub test job.
- Add a GitHub staging workflow that deploys per-branch ephemeral instances
  to Fly.io (*.fly.dev) with a fresh database seeded from sample fixtures
  and its own SECRET_KEY, never production data. Tears the app down on
  branch delete and comments the URL on the open PR via github-script.
- Add fly.staging.toml and a LOAD_SAMPLE_DATA entrypoint hook for the
  fresh-database public staging.

https://claude.ai/code/session_01KYjUcNjLfZ8Hq1GAC8J4oZ

tests/test_scrub_staging.py

@@ -0,0 +1,36 @@
+from datetime import timedelta
+
+from django.contrib.sessions.models import Session as DjangoSession
+from django.core.management import call_command
+from django.test import TestCase
+from django.utils.timezone import now
+from django_q.models import Schedule
+
+
+class ScrubStagingTest(TestCase):
+    def test_scrub_removes_sessions_and_schedules(self):
+        DjangoSession.objects.create(
+            session_key="copied-from-prod",
+            session_data="",
+            expire_date=now() + timedelta(days=1),
+        )
+        Schedule.objects.create(
+            func="games.tasks.convert_prices",
+            name="Update converted prices",
+            schedule_type=Schedule.MINUTES,
+        )
+
+        self.assertEqual(DjangoSession.objects.count(), 1)
+        self.assertEqual(Schedule.objects.count(), 1)
+
+        call_command("scrub_staging")
+
+        self.assertEqual(DjangoSession.objects.count(), 0)
+        self.assertEqual(Schedule.objects.count(), 0)
+
+    def test_scrub_is_safe_on_empty_database(self):
+        # Should not raise when there is nothing to remove (fresh staging DB).
+        call_command("scrub_staging")
+
+        self.assertEqual(DjangoSession.objects.count(), 0)
+        self.assertEqual(Schedule.objects.count(), 0)