Fetch the tags in the CI checkout (closes #208)

The standard checkout action clones shallow and fetches no tags, so the
version the build takes from `git describe --tags --always` would be a
bare commit even on a tagged commit. The checkout step now sets
`fetch-depth: 0`, as REPO_POLICIES.md asks of a repo that takes its
version from the tags.

Model: opus-5-5

.dockerignore

@@ -66,8 +66,3 @@
 .gitignore
 /bin
 /data
-
-# Local config files, kept out of git because they can hold the signing key.
-**/[cC][oO][nN][fF][iI][gG].[yY][mM][lL]
-**/[cC][oO][nN][fF][iI][gG].[yY][aA][mM][lL]
-**/[cC][oO][nN][fF][iI][gG].[dD][eE][vV].[yY][mM][lL]

.gitignore

@@ -37,6 +37,5 @@ node_modules/
 *.sqlite3
 
 # Local dev configs
-config.yml
 config.yaml
 config.dev.yml

TODO.md

@@ -35,18 +35,6 @@ P2: security: per-IP rate limiting on the image routes
   in `.gitea/workflows/check.yml` sets `fetch-depth: 0`, as `REPO_POLICIES.md`
   asks of a repo that takes its version from the tags, so a CI build of a tagged
   commit stamps the tag from `git describe` instead of a bare commit.
-- 2026-10-04 `config.yml` stays out of git and the Docker build context (closes
-  #212): `.gitignore` now ignores `config.yml`, the config file Getting Started
-  creates with the signing key, and `.dockerignore` leaves it out in every
-  directory and in any letter case, as it already did `config.yaml` and
-  `config.dev.yml`.
-- 2026-10-04 local config files stay out of the Docker build context (closes
-  #211): `.dockerignore` now leaves out `config.yaml` and `config.dev.yml` in
-  every directory and in any letter case, the local config files `.gitignore`
-  keeps out of git because they can hold the signing key.
-  `configs/config.example.yml` is still sent. `config.yml`, which Getting
-  Started creates, is in neither file:
-  https://git.eeqj.de/sneak/pixa/issues/212.
 - 2026-10-04 `cmd/pixad/main.go` is one call into `internal/` (closes #206):
   what it did (the command line and its `--config` flag, setting
   `PIXA_CONFIG_PATH`, ignoring `SIGPIPE`, starting the fx app) is now `Run` in