harden Hugo build and remove unused CMS

Dockerfile

@@ -3,20 +3,17 @@
 # under QEMU emulation). Hugo output is static HTML — identical across arches —
 # so there's no reason to run it per target arch. The runtime stage below stays
 # on TARGETPLATFORM, so multi-arch (amd64 + arm64) runtime images are preserved.
-FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.157.0 AS build
+FROM --platform=$BUILDPLATFORM ghcr.io/hugomods/hugo:0.165.0 AS build
 WORKDIR /tmp/hugo
 
-#COPY go.mod ./
-#RUN hugo mod get
-#
-#COPY archetypes ./archetypes
-#COPY assets ./assets
-#COPY content ./content
-#COPY static ./static
-#COPY themes ./themes
-#COPY hugo.* ./
+COPY go.mod go.sum ./
+COPY config ./config
+RUN hugo mod graph
 
-COPY . .
+COPY assets ./assets
+COPY content ./content
+COPY layouts ./layouts
+COPY static ./static
 RUN hugo --gc --minify
 
 FROM ghcr.io/static-web-server/static-web-server:2