Fix help-osk nginx mount: serve site/ (Zensical default output, not public/)

zensical build outputs to site/ by default; nginx was mounting the empty
public/ and returning 403 (directory index forbidden). Point the web-server
mount, .gitignore and README at site/.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

help-osk-docs/README.md

@@ -12,9 +12,9 @@ behind the existing Traefik reverse proxy.
 - `nginx.conf` — static web-server config.
 - `docker-compose.yaml` — two services:
   - `help-osk-build` — Zensical image, one-shot: runs `zensical build --clean`,
-    rendering `docs/` → `public/`, then exits. (The Zensical image is a
+    rendering `docs/` → `site/`, then exits. (The Zensical image is a
     builder, **not** a host server — by design.)
-  - `help-osk` — `nginx:alpine`, serves `public/`, joins `reverseproxy-nw`.
+  - `help-osk` — `nginx:alpine`, serves `site/`, joins `reverseproxy-nw`.
     Starts only after the build succeeds.
 - Traefik terminates TLS for `help.osk.team` (Let's Encrypt) and proxies to the
   `help-osk` container. Router/service live in
@@ -27,15 +27,15 @@ repo checkout (relative paths resolve inside Portainer's container and become
 empty dirs). So the project must exist on the host at an absolute path —
 exactly like the Traefik config. This git repo is the **source of truth**.
 
-Sync the project to the host (excluding the generated `public/`):
+Sync the project to the host (excluding the generated `site/`):
 
 ```sh
-rsync -a --delete --exclude 'public/' \
+rsync -a --delete --exclude 'site/' \
   help-osk-docs/ <docker-host>:/mnt/containers/help-osk-docs/
 ```
 
-The `help-osk-build` container creates `/mnt/containers/help-osk-docs/public`
-on the host during the build.
+The `help-osk-build` container creates `/mnt/containers/help-osk-docs/site`
+on the host during the build (Zensical's default output directory).
 
 ## Deploy (Portainer)
 
@@ -57,7 +57,7 @@ on the host during the build.
    (size with `![alt](assets/file.png){ width="600" }`).
 3. Add the page to `nav` in `zensical.toml`.
 4. Commit, re-sync to the host (step 2 above), redeploy the stack in Portainer
-   (re-runs the build; nginx serves the updated `public/`).
+   (re-runs the build; nginx serves the updated `site/`).
 
 ## Local preview (optional)