Rewrite CI to lint/typecheck/audit/test only; add HPC deployment path

- Replace the Docker build/publish CI stages with ruff (lint + format
  check), ty (type check), pip-audit, and pytest run directly against
  python:3.11-slim; Docker remains for manual/server deployment only.
- Swap black/pylint/mypy for ruff/ty across pyproject.toml, and fix
  every resulting lint, format, and type diagnostic in gallery/ and
  plotstyle/.
- Fix tests broken/stale from before the package restructuring: wrong
  `utils.*` import paths, mock patch targets pointed at the wrong
  module, and PDF-conversion tests still assuming ImageMagick instead
  of the current PyMuPDF-first path. Drop test_container.py (obsolete
  Docker-container smoke tests, fully superseded elsewhere).
- Add a plain-venv + systemd --user timer deployment path
  (deploy/systemd/) for HPC login nodes without a Docker daemon, where
  public_html is already served by existing infrastructure.
- Document both in CLAUDE.md, including running CI's checks locally
  before committing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/systemd/README.md

@@ -0,0 +1,62 @@
+# Deploying on a KIT HPC login node (no Docker daemon)
+
+This path is for machines like the ETP login nodes: `/ceph`, `/work`, `/web` are
+mounted directly, but there's no Docker daemon available, and your `public_html`
+is already served by KIT's own web infrastructure — so no web server needs to
+run here at all, only the generator on a schedule.
+
+## 1. Install into a venv
+
+```bash
+python3 -m venv ~/.venvs/gallery
+~/.venvs/gallery/bin/pip install -e /work/lbogner/ETPlot   # path to your clone
+```
+
+PyMuPDF (a base dependency) handles PDF→PNG conversion; ImageMagick is not required.
+
+## 2. Point a config at your paths
+
+Copy/edit `config.lbogner.yaml` from the repo root (already has `web_folder:
+/web/lbogner/public_html/` and placeholder `sources:` — fill in the real
+plot-output directories under `/work/lbogner/...` or `/ceph/...`). Put it
+wherever you like, e.g. `~/gallery/config.lbogner.yaml`, and adjust the path in
+`gallery-generate.service` if you move it.
+
+## 3. Install the systemd --user timer
+
+```bash
+mkdir -p ~/.config/systemd/user
+cp deploy/systemd/gallery-generate.{service,timer} ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now gallery-generate.timer
+```
+
+Check status/logs:
+
+```bash
+systemctl --user list-timers gallery-generate.timer
+journalctl --user -u gallery-generate.service -f
+```
+
+By default a user's systemd instance (and its timers) stops when you log out.
+Enable lingering so it keeps running:
+
+```bash
+loginctl enable-linger $USER
+```
+
+If lingering isn't permitted on your login node, or `systemctl --user` isn't
+usable there at all, fall back to a crontab entry instead:
+
+```
+*/5 * * * * ~/.venvs/gallery/bin/gallery --config ~/gallery/config.lbogner.yaml generate >> ~/gallery-generate.log 2>&1
+```
+
+## Why not the Docker Compose stack?
+
+`docker-compose.yml` at the repo root (generator + nginx) is for a scenario
+where you control a dedicated VM/server and need to serve the output yourself.
+On the ETP login nodes there's no Docker daemon (Apptainer/Singularity only),
+and `public_html` is already auto-served — running your own nginx there would
+be redundant. Docker is still used for CI (`.gitlab-ci.yml`) and remains a fine
+option for anyone deploying this on their own server.

deploy/systemd/gallery-generate.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Generate ETPlot gallery
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=%h/.venvs/gallery/bin/gallery --config %h/gallery/config.lbogner.yaml generate --verbose

deploy/systemd/gallery-generate.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodically regenerate the ETPlot gallery
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target