📊 experimental: Add GitNexus CI/CD and deployment configuration (#12577)

* feat: Add GitNexus CI/CD and deployment configuration

- Introduced a Dockerfile for building the GitNexus application with necessary dependencies and configurations.
- Added a Caddyfile to set up a reverse proxy with bearer token authentication for secure access to GitNexus.
- Created an entrypoint script to validate the API token and start both GitNexus and Caddy services.
- Configured Fly.io deployment settings in fly.toml, including health checks and service parameters.
- Established GitHub Actions workflows for deploying the GitNexus index and managing deployments to Fly.io.

* fix: use npx instead of bunx for native addon compatibility

bunx skips node-gyp lifecycle scripts, so @ladybugdb/core's native
.node binary never gets compiled/downloaded. npx handles this correctly.

.github/workflows/gitnexus-deploy.yml

@@ -0,0 +1,104 @@
+# Deploys the GitNexus index to Fly.io as a persistent MCP + REST server.
+#
+# Endpoints available after deploy:
+#   /api/mcp     — MCP-over-HTTP (StreamableHTTP transport)
+#   /api/query   — Search execution flows
+#   /api/search  — Hybrid BM25 + semantic search
+#   /api/repos   — List indexed repositories
+#   /api/info    — Server version and status
+#
+# First-time setup:
+#   1. flyctl apps create librechat-gitnexus
+#   2. flyctl tokens create deploy -x 999999h
+#   3. flyctl secrets set API_TOKEN=$(openssl rand -hex 32)
+#   4. Add FLY_API_TOKEN as a GitHub repo secret
+#
+# All requests (except /health) require: Authorization: Bearer <API_TOKEN>
+
+name: GitNexus Deploy
+
+on:
+  workflow_run:
+    workflows: ['GitNexus Index']
+    branches: [main]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  actions: read
+
+concurrency:
+  group: gitnexus-deploy
+  cancel-in-progress: true
+
+env:
+  GITNEXUS_VERSION: '1.5.3'
+
+jobs:
+  deploy:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout deploy config
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: .fly/gitnexus
+          fetch-depth: 1
+
+      - name: Resolve index run
+        id: resolve
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const runId = context.payload.workflow_run?.id;
+            if (runId) {
+              core.setOutput('run_id', String(runId));
+              return;
+            }
+            // workflow_dispatch: find latest successful index run on main
+            const { data } = await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'gitnexus-index.yml',
+              branch: 'main',
+              status: 'success',
+              per_page: 1,
+            });
+            if (!data.workflow_runs.length) {
+              core.setFailed('No successful GitNexus Index runs found on main');
+              return;
+            }
+            core.setOutput('run_id', String(data.workflow_runs[0].id));
+
+      - name: Download GitNexus index
+        uses: actions/download-artifact@v4
+        with:
+          name: gitnexus-index-main
+          path: deploy/.gitnexus
+          run-id: ${{ steps.resolve.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare deploy context
+        run: |
+          cp .fly/gitnexus/Dockerfile deploy/Dockerfile
+          cp .fly/gitnexus/Caddyfile deploy/Caddyfile
+          cp .fly/gitnexus/entrypoint.sh deploy/entrypoint.sh
+          echo "Deploy context:"
+          ls -la deploy/
+          ls -la deploy/.gitnexus/
+
+      - name: Setup Fly
+        uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: Deploy to Fly.io
+        working-directory: deploy
+        run: |
+          flyctl deploy \
+            --config ../.fly/gitnexus/fly.toml \
+            --build-arg GITNEXUS_VERSION=${{ env.GITNEXUS_VERSION }} \
+            --remote-only
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}