add Gitea-style admonitions, code annotations, callouts

Make the things that matter stand out, matching the Gitea callout look:
- extra.css: brand-orange warning admonitions (#f57c00, the lambda orange),
  hotter danger (#e8590c), blue note/info and cyan tip/example, plus blue
  code-annotation markers.
- deploy.md: footgun -> danger callout, secrets -> orange warning, eligible
  -> tip; Dockerfile and compose gain numbered code annotations explaining
  each magic line; paths/mounts as a table; a restart snippet for rotation.
- workflow.md: warning on setting per-repo git identity before first commit;
  tip elevating verify-by-executing.

Verified in-browser: computed border colors match (warning #f57c00,
danger #e8590c), 4 annotation markers render in brand blue, admonition
icons + tinted headers match the Gitea style. mkdocs build --strict clean.

Signed-off-by: disqualifier <dev@disqualifier.me>

docs/workflow.md

@@ -68,6 +68,12 @@ Our conventions, in short:
 - **Libraries install from git by tag** — pin a version in your deps, bump the
   tag when the lib releases.
 
+!!! warning "Set your per-repo identity *before* the first commit"
+    One machine often carries more than one Gitea identity/key. If you forget to
+    run `gitsetup` in a fresh clone, your commits attribute to the wrong
+    user — or push with the wrong key and bounce. Run it right after cloning;
+    see [per-project git identity](#handy-shell-setup).
+
 ## Git basics (our-flavored)
 
 Not a git tutorial — just how the everyday loop looks against our Gitea. For the
@@ -154,6 +160,11 @@ git diff | clip.exe   # then paste the diff straight into the chat
 Use AI for the plan and the spec, let the agent build, and always **prove it
 works by running it** — don't accept "this should work."
 
+!!! tip "Verify by executing, not asserting"
+    The single habit that separates good AI-assisted work from plausible-looking
+    nonsense: **run it**. A passing build, a real screenshot, actual output — that
+    is proof. "It should work" is not.
+
 ## Recommended setup
 
 - **WSL2 (Ubuntu) + VS Code + Claude Code.** Develop in WSL, edit in VS Code over