gitea-ci: add zip to the CI image

Lambda packaging steps in some workflows shell out to `zip`; the image
only had `unzip`. Add `zip` alongside it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ansible/roles/gitea-actions/templates/Containerfile.ci

@@ -7,7 +7,7 @@ ARG DOCKER_CLI_VERSION=27.3.1
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates curl git openssh-client make build-essential \
-        python3 python3-pip jq unzip \
+        python3 python3-pip jq zip unzip \
     && rm -rf /var/lib/apt/lists/*
 
 # Static docker client (no daemon) for jobs that run `docker build` against the

ansible/roles/podman/tasks/main.yml

@@ -84,7 +84,7 @@
 # Staging back-office (fulfillr-dev.debyltech.com) — same image, staging Turso config.
 - import_tasks: containers/debyltech/fulfillr-dev.yml
   vars:
-    image: git.debyl.io/debyltech/fulfillr:20260606.0357
+    image: git.debyl.io/debyltech/fulfillr:20260606.1523
   tags: debyltech, fulfillr-dev
 
 - import_tasks: containers/debyltech/uptime-kuma.yml

ansible/roles/podman/templates/fulfillr/dev.json.j2

@@ -13,11 +13,12 @@
   "tickets_table": "debyltech-tickets-dev",
   "store_database_url": "{{ fulfillr_dev_store_database_url }}",
   "store_auth_token": "{{ fulfillr_dev_store_auth_token }}",
+  "download_base_url": "https://api-dev.debyltech.com",
   "aws": {
     "access_key": "{{ fulfillr_dev_access_key }}",
     "secret_key": "{{ fulfillr_dev_secret_key }}",
     "region": "{{ fulfillr_region }}",
-    "bucket": "debyltech.reviewr.dev"
+    "bucket": "debyltech.digital.dev"
   },
   "tax": {
     "ein": "{{ fulfillr_tax_ein }}",