Add Gitea restart workflow and link-style "Run again" for the public view

The server deployment cannot mount the Docker socket safely, so the web
view's button now opens the Gitea page for a workflow_dispatch workflow
that recreates the stack and replays the demo. Gitea handles who may run it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker/compose.yaml

@@ -23,6 +23,8 @@ services:
       - "${VIEWER_BIND:-127.0.0.1}:8099:8080"
     environment:
       COMPOSE_PROJECT: crypto-interop-spike
+      # When set (server deployment), the page offers "Run again" as a link to the Gitea workflow page.
+      RESTART_URL: ${RESTART_URL:-}
     volumes:
       - logs:/logs
     # The "Run again" button is NOT available here; it needs compose.restart.yaml (Docker socket).

docker/viewer/index.html

@@ -239,7 +239,10 @@ for (const [id, cls] of [['onlychecks', 'only-checks'], ['hidedetail', 'hide-det
 // refresh shows the whole run again.
 // Run again: ask the viewer server to restart the whole demo (backend, boards and a fresh broker).
 // The custom header is required by the server so other web pages cannot trigger it.
+let cfg = { restart: false, restartUrl: '' };
 document.getElementById('restart').addEventListener('click', async () => {
+  // Public deployment: no Docker access here, so send the user to Gitea, which requires a login.
+  if (!cfg.restart && cfg.restartUrl) { window.open(cfg.restartUrl, '_blank', 'noopener'); return; }
   document.getElementById('restart').disabled = true;
   try {
     const r = await fetch('/api/restart', { method: 'POST', headers: { 'X-Demo-Action': 'restart' } });
@@ -259,7 +262,13 @@ function resetView() {
 }
 
 // The restart button only exists when the server was started with restart support enabled.
-fetch('/api/config').then(r => r.json()).then(c => { if (!c.restart) document.getElementById('restart').style.display = 'none'; })
+fetch('/api/config').then(r => r.json()).then(c => {
+    cfg = c;
+    const b = document.getElementById('restart');
+    if (c.restart) return;
+    if (c.restartUrl) { b.innerHTML = '↻ Run again (via Gitea)'; b.title = 'Opens Gitea, where you run the "Restart demo" workflow (login required)'; }
+    else b.style.display = 'none';
+  })
   .catch(() => { document.getElementById('restart').style.display = 'none'; });
 
 buildCards();
@@ -271,7 +280,7 @@ es.onmessage = e => add(JSON.parse(e.data));
 es.addEventListener('reset', resetView);
 es.addEventListener('status', e => {
   const s = JSON.parse(e.data);
-  document.getElementById('restart').disabled = s.busy;
+  if (cfg.restart) document.getElementById('restart').disabled = s.busy;
   document.getElementById('status').textContent = s.busy || s.text !== 'ready' ? s.text : liveText;
 });
 </script>

docker/viewer/main.go

@@ -45,7 +45,10 @@ var (
 	logDir = "/logs"
 	// The restart button needs the Docker socket; it is only enabled when the deployment says so.
 	restartEnabled = os.Getenv("RESTART_ENABLED") == "1"
-	re             = regexp.MustCompile(`^(\d\d:\d\d:\d\d\.\d{3}) \[([a-z-]+)\] (.*)$`)
+	// Without the Docker socket the page can still offer "Run again" as a link to this URL (the
+	// Gitea page that runs the restart workflow); Gitea then does the authentication.
+	restartURL = os.Getenv("RESTART_URL")
+	re         = regexp.MustCompile(`^(\d\d:\d\d:\d\d\.\d{3}) \[([a-z-]+)\] (.*)$`)
 )
 
 // tail remembers how far a file has been read and any incomplete last line.
@@ -294,7 +297,7 @@ func main() {
 		json.NewEncoder(w).Encode(lines)
 	})
 	http.HandleFunc("/api/config", func(w http.ResponseWriter, r *http.Request) {
-		json.NewEncoder(w).Encode(map[string]bool{"restart": restartEnabled})
+		json.NewEncoder(w).Encode(map[string]any{"restart": restartEnabled, "restartUrl": restartURL})
 	})
 	http.HandleFunc("/api/restart", func(w http.ResponseWriter, r *http.Request) {
 		if !restartEnabled {