diff --git a/.forgejo/workflows/cd-macmini.yml b/.forgejo/workflows/cd-macmini.yml
deleted file mode 100644
index 7e3638c6d..000000000
--- a/.forgejo/workflows/cd-macmini.yml
+++ /dev/null
@@ -1,416 +0,0 @@
-# CD Pipeline: Auto-deploy to Mac Mini on push to main
-#
-# Requires a self-hosted Forgejo Actions runner on the Mac Mini.
-# Setup: see docs/MAC_MINI_RUNNER_SETUP.md
-#
-# Flow:
-#   Push → main : Detects changed services → rebuilds & restarts only those containers
-
-name: CD Mac Mini
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      service:
-        description: 'Service to deploy (or "all" for everything)'
-        required: false
-        default: 'all'
-        type: choice
-        options:
-          - all
-          - matrix-web
-          - mana-auth
-          - mana-sync
-          - mana-media
-          - mana-notify
-          - mana-api-gateway
-          - mana-crawler
-          - mana-credits
-          - mana-search
-          - mana-matrix-bot
-          - chat-backend
-          - chat-web
-          - todo-backend
-          - todo-web
-          - calendar-backend
-          - calendar-web
-          - clock-web
-          - contacts-backend
-          - contacts-web
-          - mukke-backend
-          - mukke-web
-          - storage-backend
-          - storage-web
-
-concurrency:
-  group: cd-macmini
-  cancel-in-progress: false  # Don't cancel in-progress deploys
-
-env:
-  PROJECT_DIR: /Users/mana/projects/manacore-monorepo
-  COMPOSE_FILE: docker-compose.macmini.yml
-  ENV_FILE: .env.macmini
-  DEPLOY_NOTIFY_ROOM_ID: ${{ secrets.DEPLOY_NOTIFY_ROOM_ID }}
-  DEPLOY_NOTIFY_BOT_TOKEN: ${{ secrets.DEPLOY_NOTIFY_BOT_TOKEN }}
-  DOCKER_BUILDKIT: 1
-  PATH: /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin
-
-jobs:
-  # ===========================================
-  # Detect what changed
-  # ===========================================
-  detect-changes:
-    name: Detect Changes
-    runs-on: self-hosted
-    if: github.event_name == 'push'
-    outputs:
-      matrix-web: ${{ steps.changes.outputs.matrix-web }}
-      mana-auth: ${{ steps.changes.outputs.mana-auth }}
-      mana-sync: ${{ steps.changes.outputs.mana-sync }}
-      mana-media: ${{ steps.changes.outputs.mana-media }}
-      mana-notify: ${{ steps.changes.outputs.mana-notify }}
-      mana-api-gateway: ${{ steps.changes.outputs.mana-api-gateway }}
-      mana-crawler: ${{ steps.changes.outputs.mana-crawler }}
-      mana-credits: ${{ steps.changes.outputs.mana-credits }}
-      mana-search: ${{ steps.changes.outputs.mana-search }}
-      chat-backend: ${{ steps.changes.outputs.chat-backend }}
-      chat-web: ${{ steps.changes.outputs.chat-web }}
-      todo-backend: ${{ steps.changes.outputs.todo-backend }}
-      todo-web: ${{ steps.changes.outputs.todo-web }}
-      calendar-backend: ${{ steps.changes.outputs.calendar-backend }}
-      calendar-web: ${{ steps.changes.outputs.calendar-web }}
-      clock-web: ${{ steps.changes.outputs.clock-web }}
-      contacts-backend: ${{ steps.changes.outputs.contacts-backend }}
-      contacts-web: ${{ steps.changes.outputs.contacts-web }}
-      mukke-backend: ${{ steps.changes.outputs.mukke-backend }}
-      mukke-web: ${{ steps.changes.outputs.mukke-web }}
-      storage-backend: ${{ steps.changes.outputs.storage-backend }}
-      storage-web: ${{ steps.changes.outputs.storage-web }}
-      mana-matrix-bot: ${{ steps.changes.outputs.mana-matrix-bot }}
-      any-changes: ${{ steps.changes.outputs.any-changes }}
-    steps:
-      - name: Check for changes
-        id: changes
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-
-          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")
-
-          SHARED_CHANGED="false"
-          if echo "$CHANGED" | grep -qE "^packages/(shared-ui|shared-theme|shared-icons|shared-tailwind|shared-auth|shared-branding|shared-i18n|shared-utils|shared-types)/"; then
-            SHARED_CHANGED="true"
-          fi
-
-          check_changes() {
-            local name=$1
-            shift
-            local result="false"
-            for path in "$@"; do
-              if echo "$CHANGED" | grep -q "^$path"; then
-                result="true"
-                break
-              fi
-            done
-            if [ "$SHARED_CHANGED" == "true" ]; then
-              result="true"
-            fi
-            echo "$name=$result" >> $GITHUB_OUTPUT
-          }
-
-          echo "Changed files:"
-          echo "$CHANGED" | head -20
-          echo "Shared packages changed: $SHARED_CHANGED"
-
-          check_changes "matrix-web"       "apps/matrix/apps/web/" "apps/matrix/packages/"
-          check_changes "mana-auth"          "services/mana-auth/"
-          check_changes "mana-sync"          "services/mana-sync/" "packages/shared-go/"
-          check_changes "mana-media"         "services/mana-media/"
-          check_changes "mana-notify"        "services/mana-notify/" "packages/shared-go/"
-          check_changes "mana-api-gateway"   "services/mana-api-gateway/" "packages/shared-go/"
-          check_changes "mana-crawler"       "services/mana-crawler/" "packages/shared-go/"
-          check_changes "mana-credits"       "services/mana-credits/"
-          check_changes "mana-search"        "services/mana-search/" "packages/shared-go/"
-          check_changes "chat-backend"      "apps/chat/apps/backend/" "apps/chat/packages/"
-          check_changes "chat-web"          "apps/chat/apps/web/" "apps/chat/packages/"
-          check_changes "todo-backend"      "apps/todo/apps/backend/" "apps/todo/packages/"
-          check_changes "todo-web"          "apps/todo/apps/web/" "apps/todo/packages/"
-          check_changes "calendar-backend"  "apps/calendar/apps/backend/" "apps/calendar/packages/"
-          check_changes "calendar-web"      "apps/calendar/apps/web/" "apps/calendar/packages/"
-          check_changes "clock-web"         "apps/clock/apps/web/" "apps/clock/packages/"
-          check_changes "contacts-backend"  "apps/contacts/apps/backend/" "apps/contacts/packages/"
-          check_changes "contacts-web"      "apps/contacts/apps/web/" "apps/contacts/packages/"
-          check_changes "mukke-backend"     "apps/mukke/apps/backend/" "apps/mukke/packages/"
-          check_changes "mukke-web"         "apps/mukke/apps/web/" "apps/mukke/packages/"
-          check_changes "storage-backend"   "apps/storage/apps/backend/" "apps/storage/packages/"
-          check_changes "storage-web"       "apps/storage/apps/web/" "apps/storage/packages/"
-          check_changes "mana-matrix-bot"   "services/mana-matrix-bot/"
-          check_changes "mana-landing-builder" "services/mana-landing-builder/"
-
-          ANY="false"
-          for svc in matrix-web mana-auth mana-sync mana-media mana-notify mana-api-gateway mana-crawler mana-credits mana-search chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web mukke-backend mukke-web storage-backend storage-web mana-matrix-bot mana-landing-builder; do
-            val=$(grep "^$svc=" $GITHUB_OUTPUT | tail -1 | cut -d= -f2)
-            if [ "$val" == "true" ]; then
-              ANY="true"
-              break
-            fi
-          done
-          echo "any-changes=$ANY" >> $GITHUB_OUTPUT
-
-  # ===========================================
-  # Deploy changed services
-  # ===========================================
-  deploy:
-    name: Deploy
-    runs-on: self-hosted
-    needs: [detect-changes]
-    if: |
-      always() &&
-      (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.any-changes == 'true') ||
-      github.event_name == 'workflow_dispatch'
-    steps:
-      - name: Pull latest code
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          GIT_SSH_COMMAND='ssh -p 2222 -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no' \
-            git pull forgejo main
-
-      - name: Init deploy tracking
-        id: init
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          source scripts/deploy-metrics.sh
-          deploy_timer_start
-          echo "start_epoch=$DEPLOY_START_EPOCH" >> $GITHUB_OUTPUT
-          ensure_deploy_schema
-
-      - name: Ensure env vars exist
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          if ! grep -q "CALENDAR_ENCRYPTION_KEY" "${{ env.ENV_FILE }}" 2>/dev/null; then
-            echo "CALENDAR_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "${{ env.ENV_FILE }}"
-          fi
-
-      - name: Determine services to deploy
-        id: services
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          SERVICES=""
-
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            INPUT="${{ inputs.service }}"
-            if [ "$INPUT" == "all" ]; then
-              echo "deploy-all=true" >> $GITHUB_OUTPUT
-              exit 0
-            else
-              SERVICES="$INPUT"
-            fi
-          else
-            if [ "${{ needs.detect-changes.outputs.matrix-web }}" == "true" ]; then SERVICES="$SERVICES matrix-web"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-auth }}" == "true" ]; then SERVICES="$SERVICES mana-auth"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-sync }}" == "true" ]; then SERVICES="$SERVICES mana-sync"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-media }}" == "true" ]; then SERVICES="$SERVICES mana-media"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-notify }}" == "true" ]; then SERVICES="$SERVICES mana-notify"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-api-gateway }}" == "true" ]; then SERVICES="$SERVICES mana-api-gateway"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-crawler }}" == "true" ]; then SERVICES="$SERVICES mana-crawler"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-credits }}" == "true" ]; then SERVICES="$SERVICES mana-credits"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-search }}" == "true" ]; then SERVICES="$SERVICES mana-search"; fi
-            if [ "${{ needs.detect-changes.outputs.chat-backend }}" == "true" ]; then SERVICES="$SERVICES chat-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.chat-web }}" == "true" ]; then SERVICES="$SERVICES chat-web"; fi
-            if [ "${{ needs.detect-changes.outputs.todo-backend }}" == "true" ]; then SERVICES="$SERVICES todo-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.todo-web }}" == "true" ]; then SERVICES="$SERVICES todo-web"; fi
-            if [ "${{ needs.detect-changes.outputs.calendar-backend }}" == "true" ]; then SERVICES="$SERVICES calendar-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.calendar-web }}" == "true" ]; then SERVICES="$SERVICES calendar-web"; fi
-            if [ "${{ needs.detect-changes.outputs.clock-web }}" == "true" ]; then SERVICES="$SERVICES clock-web"; fi
-            if [ "${{ needs.detect-changes.outputs.contacts-backend }}" == "true" ]; then SERVICES="$SERVICES contacts-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.contacts-web }}" == "true" ]; then SERVICES="$SERVICES contacts-web"; fi
-            if [ "${{ needs.detect-changes.outputs.mukke-backend }}" == "true" ]; then SERVICES="$SERVICES mukke-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.mukke-web }}" == "true" ]; then SERVICES="$SERVICES mukke-web"; fi
-            if [ "${{ needs.detect-changes.outputs.storage-backend }}" == "true" ]; then SERVICES="$SERVICES storage-backend"; fi
-            if [ "${{ needs.detect-changes.outputs.storage-web }}" == "true" ]; then SERVICES="$SERVICES storage-web"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-matrix-bot }}" == "true" ]; then SERVICES="$SERVICES mana-matrix-bot"; fi
-            if [ "${{ needs.detect-changes.outputs.mana-landing-builder }}" == "true" ]; then SERVICES="$SERVICES mana-landing-builder"; fi
-          fi
-
-          echo "services=$SERVICES" >> $GITHUB_OUTPUT
-          echo "deploy-all=false" >> $GITHUB_OUTPUT
-          echo "Services to deploy: $SERVICES"
-
-      - name: Build shared base images
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          SERVICES="${{ steps.services.outputs.services }}"
-          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
-
-          NEEDS_BASE=false
-          NEEDS_WEB_BASE=false
-          if [ "$DEPLOY_ALL" == "true" ]; then
-            NEEDS_BASE=true; NEEDS_WEB_BASE=true
-          else
-            for svc in $SERVICES; do
-              case "$svc" in *-backend) NEEDS_BASE=true ;; *-web) NEEDS_WEB_BASE=true ;; esac
-            done
-          fi
-
-          if [ "$NEEDS_BASE" == "true" ]; then
-            docker build -f docker/Dockerfile.nestjs-base -t nestjs-base:local . 2>&1 | tail -5
-          fi
-          if [ "$NEEDS_WEB_BASE" == "true" ]; then
-            docker build -f docker/Dockerfile.sveltekit-base -t sveltekit-base:local . 2>&1 | tail -5
-          fi
-
-      - name: Build and deploy services
-        id: build
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          source scripts/deploy-metrics.sh
-
-          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
-          SERVICES="${{ steps.services.outputs.services }}"
-
-          if [ "$DEPLOY_ALL" == "true" ]; then
-            SERVICES=$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" config --services | tr '\n' ' ')
-          elif [ -z "$SERVICES" ]; then
-            echo "No services to deploy"
-            echo "build-times=" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-
-          echo "=== Rebuilding: $SERVICES ==="
-          BUILD_TIMES=""
-          for svc in $SERVICES; do
-            build_start=$(date +%s)
-            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" build "$svc" 2>&1 || true
-            build_end=$(date +%s)
-            BUILD_TIMES="$BUILD_TIMES $svc:$(( build_end - build_start ))"
-          done
-
-          if [ "$DEPLOY_ALL" == "true" ]; then
-            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d
-          else
-            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-deps $SERVICES
-          fi
-          sleep 10
-
-          echo "build-times=$BUILD_TIMES" >> $GITHUB_OUTPUT
-
-      - name: Health checks
-        id: health
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          source scripts/deploy-metrics.sh
-
-          health_url_for() {
-            case "$1" in
-              mana-auth)         echo "http://localhost:3001/health" ;;
-              matrix-web)        echo "http://localhost:5180/health" ;;
-              chat-backend)      echo "http://localhost:3030/health" ;;
-              chat-web)          echo "http://localhost:5010/health" ;;
-              todo-backend)      echo "http://localhost:3031/health" ;;
-              todo-web)          echo "http://localhost:5011/health" ;;
-              calendar-backend)  echo "http://localhost:3032/health" ;;
-              calendar-web)      echo "http://localhost:5012/health" ;;
-              clock-web)         echo "http://localhost:5013/health" ;;
-              contacts-backend)  echo "http://localhost:3034/health" ;;
-              contacts-web)      echo "http://localhost:5014/health" ;;
-              mukke-backend)     echo "http://localhost:3010/health" ;;
-              mukke-web)         echo "http://localhost:5180/health" ;;
-              storage-backend)   echo "http://localhost:3035/api/v1/health" ;;
-              storage-web)       echo "http://localhost:5015/health" ;;
-              *)                 echo "" ;;
-            esac
-          }
-
-          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
-          SERVICES="${{ steps.services.outputs.services }}"
-          if [ "$DEPLOY_ALL" == "true" ]; then
-            SERVICES="mana-auth chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web storage-backend storage-web"
-          fi
-
-          HEALTH_RESULTS=""
-          for svc in $SERVICES; do
-            url=$(health_url_for "$svc")
-            if [ -z "$url" ]; then
-              HEALTH_RESULTS="$HEALTH_RESULTS $svc:skipped:0:0"
-              continue
-            fi
-            result=$(check_health_timed "$svc" "$url" 2>/dev/null) || true
-            status=$(echo "$result" | awk '{print $1}')
-            elapsed=$(echo "$result" | awk '{print $2}')
-            http_code=$(echo "$result" | awk '{print $3}')
-            HEALTH_RESULTS="$HEALTH_RESULTS $svc:${status:-skipped}:${http_code:-0}:${elapsed:-0}"
-            [ "$status" = "ok" ] && echo "  ✓ $svc" || echo "  ✗ $svc ($status)"
-          done
-
-          echo "health-results=$HEALTH_RESULTS" >> $GITHUB_OUTPUT
-
-      - name: Record deploy metrics
-        if: always()
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          source scripts/deploy-metrics.sh
-
-          START_EPOCH="${{ steps.init.outputs.start_epoch }}"
-          DURATION=$(( $(date +%s) - START_EPOCH ))
-          STATUS="success"
-          [ "${{ job.status }}" != "success" ] && STATUS="failure"
-
-          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
-          SERVICES="${{ steps.services.outputs.services }}"
-          [ "$DEPLOY_ALL" == "true" ] && SERVICES_CSV="all" || SERVICES_CSV=$(echo "$SERVICES" | tr ' ' ',')
-
-          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 200 || echo "unknown")
-          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-
-          DEPLOY_ID=$(insert_deployment \
-            "${{ github.run_id }}" "${{ github.run_attempt }}" \
-            "${{ github.sha }}" "$COMMIT_MSG" \
-            "${{ github.ref_name }}" "${{ github.event_name }}" \
-            "${{ github.actor }}" "$SERVICES_CSV" "$STATUS" 2>/dev/null) || DEPLOY_ID=""
-
-          if [ -n "$DEPLOY_ID" ]; then
-            finalise_deployment "$DEPLOY_ID" "$STATUS" "$DURATION" 2>/dev/null || true
-            BUILD_TIMES="${{ steps.build.outputs.build-times }}"
-            HEALTH_RESULTS="${{ steps.health.outputs.health-results }}"
-            ALL_SVCS=$(echo "$BUILD_TIMES $HEALTH_RESULTS" | tr ' ' '\n' | cut -d: -f1 | sort -u | tr '\n' ' ')
-            for svc in $ALL_SVCS; do
-              [ -z "$svc" ] && continue
-              build_dur=$(echo "$BUILD_TIMES" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "0")
-              startup=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f4 || echo "0")
-              health=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "skipped")
-              http_code=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f3 || echo "0")
-              img_mb=$(get_image_size_mb "$svc" 2>/dev/null || echo "0")
-              insert_deploy_service "$DEPLOY_ID" "$svc" "${build_dur:-0}" "$img_mb" "${startup:-0}" "${health:-skipped}" "${http_code:-0}" 2>/dev/null || true
-              push_service_metrics "$svc" "${build_dur:-0}" "$img_mb" "$health" 2>/dev/null || true
-            done
-          fi
-          push_deploy_metrics "$STATUS" "$DURATION" "${{ github.ref_name }}" 2>/dev/null || true
-
-      - name: Notify on failure
-        if: failure()
-        run: |
-          cd "${{ env.PROJECT_DIR }}"
-          SERVICES="${{ steps.services.outputs.services }}"
-          [ "${{ steps.services.outputs.deploy-all }}" == "true" ] && SERVICES="all"
-          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 100)
-          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          MSG="⚠️ **Deploy failed**\n\n**Services:** ${SERVICES}\n**Commit:** ${COMMIT_MSG}\n**By:** ${{ github.actor }}\n**[View logs](${RUN_URL})**"
-
-          ROOM_ID="${DEPLOY_NOTIFY_ROOM_ID:-}"
-          BOT_TOKEN="${DEPLOY_NOTIFY_BOT_TOKEN:-}"
-          if [ -n "$ROOM_ID" ] && [ -n "$BOT_TOKEN" ]; then
-            TXN_ID="deploy-$(date +%s)"
-            curl -s -X PUT \
-              "http://localhost:8008/_matrix/client/v3/rooms/${ROOM_ID}/send/m.room.message/${TXN_ID}" \
-              -H "Authorization: Bearer ${BOT_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "{\"msgtype\":\"m.text\",\"body\":\"Deploy failed: ${SERVICES}\"}" || true
-          fi
-
-      - name: Cleanup old images
-        if: always()
-        run: |
-          docker image prune -f 2>/dev/null || true
-          docker image prune -a -f --filter "until=168h" 2>/dev/null || true
diff --git a/.github/workflows/mirror-to-forgejo.yml b/.github/workflows/mirror-to-forgejo.yml
index a8446fbbe..af7e8bcee 100644
--- a/.github/workflows/mirror-to-forgejo.yml
+++ b/.github/workflows/mirror-to-forgejo.yml
@@ -1,9 +1,8 @@
 # Mirror GitHub → Forgejo on every push to main
-# Keeps Forgejo in sync so it can serve as the deployment source.
+# Keeps Forgejo in sync as a backup/visibility mirror.
+# GitHub handles CI/CD via native self-hosted runner; Forgejo is mirror-only.
 #
-# Requires GitHub secret:
-#   FORGEJO_DEPLOY_KEY  — private SSH key matching mac-mini-deploy key in Forgejo
-#   (key fingerprint: SHA256:baNsV+pq28d1vSWX+jtqyV0GqRnjUcHfDZM8RopcGDE)
+# Requires: Mac Mini self-hosted runner with SSH access to Forgejo (localhost:2222)
 
 name: Mirror to Forgejo
 
diff --git a/docker-compose.macmini.yml b/docker-compose.macmini.yml
index bc57f5a42..fc40c8aff 100644
--- a/docker-compose.macmini.yml
+++ b/docker-compose.macmini.yml
@@ -239,21 +239,9 @@ services:
       retries: 3
       start_period: 30s
 
-  forgejo-runner:
-    image: code.forgejo.org/forgejo/runner:6.3.1
-    container_name: mana-core-forgejo-runner
-    command: forgejo-runner daemon
-    restart: always
-    mem_limit: 256m
-    user: "0:0"
-    depends_on:
-      forgejo:
-        condition: service_healthy
-    environment:
-      DOCKER_HOST: unix:///var/run/docker.sock
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /Volumes/ManaData/forgejo-runner:/data
+  # Forgejo runner removed — no macOS binary exists, Docker-based runner
+  # can't access host filesystem/SSH for CD. GitHub CD handles deployment
+  # via native self-hosted runner. Forgejo is kept as a mirror only.
 
   # ============================================
   # Tier 1: Core Auth Service (Port 3001)