ci: add Drone pipeline for ai.puro.im deployment

- .drone.yml: pnpm build frontend → go build backend → docker compose up
- .ci/Dockerfile: distroless:nonroot runtime image
- host state (/opt/sub2api/{config.yaml,compose,volumes}) stays untouched

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.ci/Dockerfile

@@ -0,0 +1,5 @@
+FROM gcr.io/distroless/static-debian12:nonroot
+WORKDIR /app
+COPY sub2api-linux /app/sub2api
+EXPOSE 8080
+ENTRYPOINT ["/app/sub2api"]

.ci/README.md

@@ -0,0 +1,13 @@
+# ai.puro.im CI artifacts
+
+Drone CI (see `.drone.yml`) builds a statically-linked `sub2api-linux` binary and bakes it into this distroless image.
+
+Host-side state (NOT in repo):
+- `/opt/sub2api/docker-compose.yml` — sub2api + sub2api-pg + sub2api-redis services + PG password
+- `/opt/sub2api/app-data/config.yaml` — wizard-generated runtime config
+- `/opt/sub2api/{pg-data,redis-data,app-data,logs}` — persistent volumes
+
+Deploy flow:
+1. Drone builds frontend (pnpm) + backend (go, linux/amd64)
+2. CI copies `backend/sub2api-linux` + `.ci/Dockerfile` to `/opt/sub2api/`
+3. CI runs `docker compose up -d --build sub2api` — rebuilds only sub2api service, leaves PG/Redis untouched