CI: make builds work on China-based self-hosted Gitea runner

The self-hosted Windows runner can't reach github.com (GFW), so the previous
workflow failed cloning actions/checkout and would also fail downloading the
Flutter SDK and the sqlite3 native binary.

- Vendor the official, SHA-256-verified sqlite3 binaries under vendor/sqlite3/
  and select them via pubspec hooks.user_defines (source: test-sqlite3). Builds
  and tests now run fully offline — no GitHub download, no proxy, no
  LD_LIBRARY_PATH hack (removed .local-sqlite/).
- Consolidate CI into one Windows workflow: fetch actions from the gitea.com
  mirror, use the runner's pre-installed Flutter (no SDK download), and use the
  flutter-io.cn pub/Flutter mirrors. Server tests use the Tsinghua PyPI mirror.
- Document the offline build + China mirrors in README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -26,14 +26,31 @@ flutter build windows --release
 
 Output: `build\windows\x64\runner\Release\badnote.exe`
 
-If native asset downloads fail (e.g. sqlite3), set a proxy before building:
+The `sqlite3` native binary is **vendored** under `vendor/sqlite3/` (configured via
+`hooks.user_defines` in `pubspec.yaml`), so the build does not download anything
+from GitHub — it works fully offline / behind a firewall. To add another
+platform or architecture, drop its official release binary from
+[sqlite3.dart releases](https://github.com/simolus3/sqlite3.dart/releases) into
+`vendor/sqlite3/` (the build validates each file's SHA-256).
+
+In mainland China, point pub/Flutter at the local mirrors:
 
 ```powershell
-$env:HTTP_PROXY="http://127.0.0.1:7890"
-$env:HTTPS_PROXY="http://127.0.0.1:7890"
+$env:PUB_HOSTED_URL="https://pub.flutter-io.cn"
+$env:FLUTTER_STORAGE_BASE_URL="https://storage.flutter-io.cn"
+flutter pub get
 flutter build windows --release
 ```
 
+## Continuous integration
+
+`.gitea/workflows/ci.yml` runs format + analyze + test + Windows release build on
+a self-hosted **Windows** runner. It is written for runners behind the GFW:
+actions come from the `gitea.com` mirror, Flutter is expected to be
+pre-installed on the runner, and pub uses the `flutter-io.cn` mirror. If
+`gitea.com` is unreachable too, set `DEFAULT_ACTIONS_URL=https://gitea.com` (or
+your own mirror) in the runner config and use bare `actions/checkout@v4`.
+
 ## Architecture
 
 ```