feat(deploy): containerize api + web for single-host docker-compose

- apps/api/Dockerfile: multi-stage build, runs prisma migrate deploy on
  boot. Workspace package.json "main/exports" rewritten to dist so Node
  ESM resolves compiled JS at runtime.
- apps/web/Dockerfile + nginx.conf: static build served by nginx with
  SPA fallback, gzip, cache-bust on hashed assets, and /api reverse
  proxy to the internal api service.
- docker-compose.yml: production-oriented stack — api (SQLite on a
  named volume), web (exposes WEB_PORT), redis (for the upcoming
  worker). Postgres dropped since schema still targets SQLite.
- .dockerignore: keep build context lean.
- ci: add docker job gated on push-to-main that builds and pushes both
  images to ${{ vars.REGISTRY_URL }} using ${{ secrets.REGISTRY_TOKEN }}.
  Tags :latest + :${github.sha}.

.gitea/workflows/ci.yaml

@@ -90,3 +90,42 @@ jobs:
           name: playwright-report
           path: apps/e2e/playwright-report
           retention-days: 7
+
+  docker:
+    name: Build & push images
+    runs-on: ubuntu-latest
+    needs: check
+    # Only push from main, and only on direct pushes (not PRs from forks).
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to ${{ vars.REGISTRY_URL }}
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ vars.REGISTRY_URL }}" --username "${{ github.actor }}" --password-stdin
+
+      - name: Build & push API image
+        run: |
+          IMAGE="${{ vars.REGISTRY_URL }}/vector-api"
+          docker build \
+            -f apps/api/Dockerfile \
+            -t "$IMAGE:${{ github.sha }}" \
+            -t "$IMAGE:latest" \
+            .
+          docker push "$IMAGE:${{ github.sha }}"
+          docker push "$IMAGE:latest"
+
+      - name: Build & push Web image
+        run: |
+          IMAGE="${{ vars.REGISTRY_URL }}/vector-web"
+          docker build \
+            -f apps/web/Dockerfile \
+            -t "$IMAGE:${{ github.sha }}" \
+            -t "$IMAGE:latest" \
+            .
+          docker push "$IMAGE:${{ github.sha }}"
+          docker push "$IMAGE:latest"
+
+      - name: Log out
+        if: always()
+        run: docker logout "${{ vars.REGISTRY_URL }}"