docs: two-repo Gitea workflow and LXC sync script for Ali operator

Add FORGE_CANONICAL_REGISTRY, ALI_GITEA_TWO_REPO_WORKFLOW, and sync-ali-omnl-banking-portal-lxcs.sh for banking LXCs 5820-5828.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Sync OMNL banking portal to all Ali banking LXCs (5820–5828) via Proxmox pct.
+#
+# Usage:
+#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh           # dry-run
+#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply   # deploy all
+#
+# Requires: root SSH to OMNL_PVE_HOST (default 192.168.11.13), built repo at ~/smom-dbis-138
+
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+DEPLOY_SCRIPT="${REPO_DIR}/scripts/deployment/deploy-omnl-banking-portal-pct.sh"
+APPLY=false
+
+if [[ "${1:-}" == "--apply" ]]; then
+  APPLY=true
+fi
+
+# Banking portal LXCs — one per public FQDN product surface
+CTIDS=(5820 5821 5822 5823 5824 5825 5826 5827 5828)
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [[ ! -x "$DEPLOY_SCRIPT" ]]; then
+  echo "Missing deploy script: $DEPLOY_SCRIPT" >&2
+  exit 1
+fi
+
+log "OMNL banking LXC sync — CTIDs: ${CTIDS[*]}"
+log "Mode: $(if $APPLY; then echo APPLY; else echo DRY-RUN; fi)"
+log "Repo: $REPO_DIR"
+
+for CTID in "${CTIDS[@]}"; do
+  if $APPLY; then
+    log "Deploying CT $CTID..."
+    OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT"
+  else
+    log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_HOST:-192.168.11.13})"
+  fi
+done
+
+if $APPLY; then
+  log "All ${#CTIDS[@]} banking LXCs synced."
+else
+  log "Dry-run complete. Re-run with --apply to deploy."
+fi