Fix help-osk nginx mount: serve site/ (Zensical default output, not public/)

zensical build outputs to site/ by default; nginx was mounting the empty
public/ and returning 403 (directory index forbidden). Point the web-server
mount, .gitignore and README at site/.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

help-osk-docs/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   # One-shot builder. Zensical's official image is for builds/previews only
-  # (NOT a host server), so we use it to render docs/ -> public/, then exit.
+  # (NOT a host server), so we use it to render docs/ -> site/, then exit.
   help-osk-build:
     image: zensical/zensical:latest
     container_name: help-osk-build
@@ -8,7 +8,7 @@ services:
     command: ["build", "--clean"]
     restart: "no"
     volumes:
-      # Whole project (zensical.toml + docs/ + writes public/) on the host.
+      # Whole project (zensical.toml + docs/ + writes site/) on the host.
       #
       # NOTE: absolute host path (NOT ./relative). Portainer GitOps runs compose
       # with paths relative to its own container (/data/compose/<id>/...), which
@@ -17,7 +17,7 @@ services:
       # of truth), same as the traefik config.
       - /mnt/containers/help-osk-docs:/docs:z
 
-  # Static web server. Serves the generated public/ and joins the Traefik
+  # Static web server. Serves the generated site/ and joins the Traefik
   # reverse-proxy network; Traefik terminates TLS for help.osk.team.
   help-osk:
     image: nginx:alpine
@@ -27,7 +27,7 @@ services:
       help-osk-build:
         condition: service_completed_successfully
     volumes:
-      - /mnt/containers/help-osk-docs/public:/usr/share/nginx/html:ro,z
+      - /mnt/containers/help-osk-docs/site:/usr/share/nginx/html:ro,z
       - /mnt/containers/help-osk-docs/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z
     networks:
       - reverseproxy-nw