feat: build and publish release images from version tags

Tagging v* builds both images on Gitea Actions and pushes them to the instance
registry, then smoke-tests the published stack. The frontend read its backend
URL through import.meta.env, which Vite resolves at build time, so an image
could only point at whatever the build host had; it now reads it at runtime.

frontend/Dockerfile

@@ -11,7 +11,9 @@ WORKDIR /app
 
 FROM base AS prod-deps
 
-COPY pnpm-lock.yaml ./
+# pnpm-workspace.yaml carries onlyBuiltDependencies; without it pnpm blocks the postinstall
+# scripts it lists, so the install here would not match a local one.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 
 RUN --mount=type=cache,target=/pnpm/store \
     pnpm fetch --frozen-lockfile
@@ -25,7 +27,7 @@ RUN --mount=type=cache,target=/pnpm/store \
 
 FROM base AS build
 
-COPY pnpm-lock.yaml package.json ./
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
 
 RUN --mount=type=cache,target=/pnpm/store \
     pnpm install --frozen-lockfile
@@ -54,4 +56,7 @@ EXPOSE 3000
 
 WORKDIR /app
 
+HEALTHCHECK --interval=10s --timeout=3s --retries=5 --start-period=10s \
+  CMD ["node", "-e", "fetch(`http://127.0.0.1:${process.env.PORT || 3000}/login`).then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
+
 CMD [ "node", "build" ]

frontend/package.json

@@ -2,6 +2,7 @@
 	"name": "chitai-web",
 	"private": true,
 	"version": "0.0.1",
+	"packageManager": "pnpm@11.20.0",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",

frontend/src/lib/server/config.ts

@@ -1 +1,5 @@
-export const BACKEND_API_URL = import.meta.env.VITE_BACKEND_API_URL || 'http://localhost:8000';
+import { env } from '$env/dynamic/private';
+
+// Read at runtime, not build time: `import.meta.env` is substituted by Vite during the build, so a
+// published image would carry whatever the build host had — see docs/ci-release-pipeline.md.
+export const BACKEND_API_URL = env.VITE_BACKEND_API_URL || 'http://localhost:8000';