feat: build and publish release images from version tags

Tagging v* builds both images on Gitea Actions and pushes them to the instance
registry, then smoke-tests the published stack. The frontend read its backend
URL through import.meta.env, which Vite resolves at build time, so an image
could only point at whatever the build host had; it now reads it at runtime.

frontend/Dockerfile

@@ -11,7 +11,9 @@ WORKDIR /app
 
 FROM base AS prod-deps
 
-COPY pnpm-lock.yaml ./
+# pnpm-workspace.yaml carries onlyBuiltDependencies; without it pnpm blocks the postinstall
+# scripts it lists, so the install here would not match a local one.
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
 
 RUN --mount=type=cache,target=/pnpm/store \
     pnpm fetch --frozen-lockfile
@@ -25,7 +27,7 @@ RUN --mount=type=cache,target=/pnpm/store \
 
 FROM base AS build
 
-COPY pnpm-lock.yaml package.json ./
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
 
 RUN --mount=type=cache,target=/pnpm/store \
     pnpm install --frozen-lockfile
@@ -54,4 +56,7 @@ EXPOSE 3000
 
 WORKDIR /app
 
+HEALTHCHECK --interval=10s --timeout=3s --retries=5 --start-period=10s \
+  CMD ["node", "-e", "fetch(`http://127.0.0.1:${process.env.PORT || 3000}/login`).then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
+
 CMD [ "node", "build" ]