Add registry-based prod promotion, separate from auto dev deploy

Dev keeps auto-deploying on every push to main, same as before, but now
also publishes each build to git.jerodrigged.com's container registry
tagged by short commit SHA (best-effort - never blocks the dev deploy
if REGISTRY_TOKEN isn't set yet).

Prod deploys only on an intentional `git push origin main:prod`, and
only ever pulls a pre-built SHA-tagged image - it never rebuilds from
source. This guarantees prod runs the exact artifact dev already
validated, and makes promoting an untested commit fail loudly (pull of
a nonexistent tag) instead of silently rebuilding something new.

Needs new secrets before the prod path works: PROD_SSH_KEY, PROD_HOST,
PROD_USER, REGISTRY_USER, REGISTRY_TOKEN. PROD_SSH_KEY/PROD_HOST/
REGISTRY_USER are already set; PROD_USER and REGISTRY_TOKEN still need
Jerod's input.

.gitea/workflows/deploy.yml

@@ -34,6 +34,20 @@ jobs:
                git fetch origin
                git reset --hard origin/main
                docker compose build
+               SHA=$(git rev-parse --short HEAD)
+               if [ -n "${{ secrets.REGISTRY_TOKEN }}" ]; then
+                 set +e
+                 echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jerodrigged.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin \
+                   && docker tag lisilou-portfolio-web:local git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:$SHA \
+                   && docker tag lisilou-portfolio-api:local git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:$SHA \
+                   && docker push git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:$SHA \
+                   && docker push git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:$SHA \
+                   && echo "Published $SHA to registry" \
+                   || echo "WARNING: registry publish failed, continuing deploy anyway"
+                 set -e
+               else
+                 echo "REGISTRY_TOKEN not set - skipping registry publish (prod promotion unavailable until configured)"
+               fi
                docker compose up -d
                echo "Deploy complete"'