feat: build and publish release images from version tags

Tagging v* builds both images on Gitea Actions and pushes them to the instance
registry, then smoke-tests the published stack. The frontend read its backend
URL through import.meta.env, which Vite resolves at build time, so an image
could only point at whatever the build host had; it now reads it at runtime.

frontend/src/lib/server/config.ts

@@ -1 +1,5 @@
-export const BACKEND_API_URL = import.meta.env.VITE_BACKEND_API_URL || 'http://localhost:8000';
+import { env } from '$env/dynamic/private';
+
+// Read at runtime, not build time: `import.meta.env` is substituted by Vite during the build, so a
+// published image would carry whatever the build host had — see docs/ci-release-pipeline.md.
+export const BACKEND_API_URL = env.VITE_BACKEND_API_URL || 'http://localhost:8000';