Fix help-osk nginx mount: serve site/ (Zensical default output, not public/)

zensical build outputs to site/ by default; nginx was mounting the empty
public/ and returning 403 (directory index forbidden). Point the web-server
mount, .gitignore and README at site/.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

help-osk-docs/.gitignore

@@ -1,3 +1,3 @@
 # Build output — generated by `zensical build`, not tracked.
-/public/
+/site/
 .DS_Store

help-osk-docs/README.md

@@ -12,9 +12,9 @@ behind the existing Traefik reverse proxy.
 - `nginx.conf` — static web-server config.
 - `docker-compose.yaml` — two services:
   - `help-osk-build` — Zensical image, one-shot: runs `zensical build --clean`,
-    rendering `docs/` → `public/`, then exits. (The Zensical image is a
+    rendering `docs/` → `site/`, then exits. (The Zensical image is a
     builder, **not** a host server — by design.)
-  - `help-osk` — `nginx:alpine`, serves `public/`, joins `reverseproxy-nw`.
+  - `help-osk` — `nginx:alpine`, serves `site/`, joins `reverseproxy-nw`.
     Starts only after the build succeeds.
 - Traefik terminates TLS for `help.osk.team` (Let's Encrypt) and proxies to the
   `help-osk` container. Router/service live in
@@ -27,15 +27,15 @@ repo checkout (relative paths resolve inside Portainer's container and become
 empty dirs). So the project must exist on the host at an absolute path —
 exactly like the Traefik config. This git repo is the **source of truth**.
 
-Sync the project to the host (excluding the generated `public/`):
+Sync the project to the host (excluding the generated `site/`):
 
 ```sh
-rsync -a --delete --exclude 'public/' \
+rsync -a --delete --exclude 'site/' \
   help-osk-docs/ <docker-host>:/mnt/containers/help-osk-docs/
 ```
 
-The `help-osk-build` container creates `/mnt/containers/help-osk-docs/public`
+The `help-osk-build` container creates `/mnt/containers/help-osk-docs/site`
-on the host during the build.
+on the host during the build (Zensical's default output directory).
 
 ## Deploy (Portainer)
 
@@ -57,7 +57,7 @@ on the host during the build.
    (size with `![alt](assets/file.png){ width="600" }`).
 3. Add the page to `nav` in `zensical.toml`.
 4. Commit, re-sync to the host (step 2 above), redeploy the stack in Portainer
-   (re-runs the build; nginx serves the updated `public/`).
+   (re-runs the build; nginx serves the updated `site/`).
 
 ## Local preview (optional)
 

help-osk-docs/docker-compose.yaml

@@ -1,6 +1,6 @@
 services:
   # One-shot builder. Zensical's official image is for builds/previews only
-  # (NOT a host server), so we use it to render docs/ -> public/, then exit.
+  # (NOT a host server), so we use it to render docs/ -> site/, then exit.
   help-osk-build:
     image: zensical/zensical:latest
     container_name: help-osk-build
@@ -8,7 +8,7 @@ services:
     command: ["build", "--clean"]
     restart: "no"
     volumes:
-      # Whole project (zensical.toml + docs/ + writes public/) on the host.
+      # Whole project (zensical.toml + docs/ + writes site/) on the host.
       #
       # NOTE: absolute host path (NOT ./relative). Portainer GitOps runs compose
       # with paths relative to its own container (/data/compose/<id>/...), which
@@ -17,7 +17,7 @@ services:
       # of truth), same as the traefik config.
       - /mnt/containers/help-osk-docs:/docs:z
 
-  # Static web server. Serves the generated public/ and joins the Traefik
+  # Static web server. Serves the generated site/ and joins the Traefik
   # reverse-proxy network; Traefik terminates TLS for help.osk.team.
   help-osk:
     image: nginx:alpine
@@ -27,7 +27,7 @@ services:
       help-osk-build:
         condition: service_completed_successfully
     volumes:
-      - /mnt/containers/help-osk-docs/public:/usr/share/nginx/html:ro,z
+      - /mnt/containers/help-osk-docs/site:/usr/share/nginx/html:ro,z
       - /mnt/containers/help-osk-docs/nginx.conf:/etc/nginx/conf.d/default.conf:ro,z
     networks:
       - reverseproxy-nw