feat: build and publish release images from version tags

Tagging v* builds both images on Gitea Actions and pushes them to the instance
registry, then smoke-tests the published stack. The frontend read its backend
URL through import.meta.env, which Vite resolves at build time, so an image
could only point at whatever the build host had; it now reads it at runtime.

.env.prod-example

@@ -1,6 +1,15 @@
 # Change this secret to something random
 CHITAI_TOKEN_SECRET=secret
 
+# Which release to run. Pin this to a tag (e.g. 0.1.0) for a real deployment so a
+# restart cannot silently move you to a newer image.
+CHITAI_VERSION=latest
+
+# The URL you reach the app on, exactly as it appears in the browser. Logging in fails
+# with a 403 if this does not match, because SvelteKit rejects the form POST as
+# cross-origin. Include the port unless it is the scheme default.
+CHITAI_ORIGIN=http://localhost:3000
+
 # Setup the path to your initial library (optional)
 CHITAI_DEFAULT_LIBRARY_NAME=Books
 CHITAI_DEFAULT_LIBRARY_PATH="libraries/books"