ci: add Gitea workflow to build and push image on main

Same auto-build setup as CncApi and LaserQuote.Web so all forge
services publish to the Gitea registry on push instead of the
manual docker save/load flow.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build-pepapi.yml

@@ -0,0 +1,28 @@
+name: Build PepApi image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "PepApi.Core/**"
+      - "PepLib.Core/**"
+      - "Dockerfile"
+      - ".gitea/workflows/build-pepapi.yml"
+  workflow_dispatch: {}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to Gitea container registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.thecozycat.net -u "${{ gitea.actor }}" --password-stdin
+
+      - name: Build image
+        run: docker build -t git.thecozycat.net/${{ gitea.repository_owner }}/pepapi:latest -t git.thecozycat.net/${{ gitea.repository_owner }}/pepapi:${{ gitea.sha }} .
+
+      - name: Push image
+        run: |
+          docker push git.thecozycat.net/${{ gitea.repository_owner }}/pepapi:latest
+          docker push git.thecozycat.net/${{ gitea.repository_owner }}/pepapi:${{ gitea.sha }}

PepApi.Core/Controllers/NestsController.cs

@@ -409,11 +409,12 @@ public class NestsController : ControllerBase
     private async Task<NestDetails> GetNestDetailsAsync(string nestFilePath)
     {
         var nest = Nest.Load(nestFilePath);
-        var dir = Path.GetDirectoryName(nestFilePath) + "\\";
         var name = Path.GetFileNameWithoutExtension(nestFilePath).ToUpper();
 
         var info = await _db.NestHeaders
-            .FirstOrDefaultAsync(n => n.NestName.ToUpper() == name && dir == n.Path);
+            .Where(n => n.NestName.ToUpper() == name)
+            .OrderByDescending(n => n.DateProgrammed)
+            .FirstOrDefaultAsync();
 
         if (info == null)
             throw new Exception("Nest header not found in database");

PepLib.Core.Tests/IO/NestReaderTests.cs

@@ -0,0 +1,33 @@
+using PepLib.IO;
+using Xunit;
+
+namespace PepLib.Core.Tests.IO;
+
+public class NestReaderTests
+{
+    [Fact]
+    public void Read_ReadOnlyFile_DoesNotRequestWriteAccess()
+    {
+        // Arrange: a file on a read-only mount denies write-access opens (EROFS on Linux,
+        // UnauthorizedAccessException on Windows when the read-only attribute is set).
+        // NestReader only ever reads nest files, so it must never request FileAccess.Write.
+        var path = Path.GetTempFileName();
+        try
+        {
+            File.SetAttributes(path, FileAttributes.ReadOnly);
+
+            var reader = new NestReader();
+
+            // Act / Assert: opening must succeed (i.e. not throw because of the read-only
+            // attribute). Parsing the empty/invalid content is expected to fail separately.
+            var ex = Record.Exception(() => reader.Read(path));
+
+            Assert.IsNotType<UnauthorizedAccessException>(ex);
+        }
+        finally
+        {
+            File.SetAttributes(path, FileAttributes.Normal);
+            File.Delete(path);
+        }
+    }
+}

PepLib.Core/IO/NestReader.cs

@@ -86,7 +86,7 @@ namespace PepLib.IO
 
             try
             {
-                stream = new FileStream(nestFile, FileMode.Open);
+                stream = new FileStream(nestFile, FileMode.Open, FileAccess.Read, FileShare.Read);
                 Read(stream);
             }
             finally