feat: add CI status indicator and favicon

- Add CI status badge in header (auto-syncs from Forgejo)
- Add rock-svg-icon.svg as favicon for Chrome
- Add SOPS encrypted secrets for Forgejo token
- Add decrypt script for local dev

app/api/ci-status/route.ts

@@ -0,0 +1,57 @@
+import { NextResponse } from 'next/server'
+
+const FORGEJO_URL = 'https://forgejo.riotpiao.com'
+const REPO = 'rock/riotpiao.com'
+
+export async function GET() {
+  const token = process.env.FORGEJO_TOKEN
+
+  if (!token) {
+    return NextResponse.json(
+      { error: 'FORGEJO_TOKEN not configured' },
+      { status: 500 }
+    )
+  }
+
+  try {
+    const response = await fetch(
+      `${FORGEJO_URL}/api/v1/repos/${REPO}/actions/runs?limit=1`,
+      {
+        headers: {
+          Authorization: `token ${token}`,
+          Accept: 'application/json',
+        },
+        cache: 'no-store',
+      }
+    )
+
+    if (!response.ok) {
+      throw new Error(`Forgejo API error: ${response.status}`)
+    }
+
+    const data = await response.json()
+    const latestRun = data.workflow_runs?.[0]
+
+    if (!latestRun) {
+      return NextResponse.json({
+        status: 'unknown',
+        message: 'No runs found',
+      })
+    }
+
+    return NextResponse.json({
+      status: latestRun.status,
+      conclusion: latestRun.conclusion,
+      title: latestRun.display_title || latestRun.head_branch,
+      branch: latestRun.head_branch,
+      url: latestRun.html_url,
+      updatedAt: latestRun.completed_at || latestRun.started_at,
+    })
+  } catch (error) {
+    console.error('CI status fetch error:', error)
+    return NextResponse.json(
+      { error: 'Failed to fetch CI status', status: 'error' },
+      { status: 500 }
+    )
+  }
+}

app/layout.tsx

@@ -6,6 +6,10 @@ import { LanguageProvider } from '@/lib/LanguageContext'
 export const metadata = {
   title: 'Rock Liang — Portfolio & Live Infrastructure',
   description: 'Personal portfolio showcasing Kubernetes, Terraform, and cloud-native systems.',
+  icons: {
+    icon: '/rock-svg-icon.svg',
+    apple: '/rock-svg-icon.svg',
+  },
 };
 
 export default function RootLayout({