feat: setup phase 3 agent infrastructure + enable docker ci on prs

- Enable docker build, sha extraction on PRs (validate Dockerfile)
   - Add SOPS encrypted memory-agent credentials
   - Plan 15 tasks: 5 memory service + 10 temporal workflow
   - Milestone: monitoring-agent (due 2025-03-15)
   - Ready: Forgejo API token needed for PR automation
 ```

Co-authored-by: rock <[email protected]>

k8s/app/config.yaml

@@ -21,3 +21,8 @@ data:
   OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
   # Obsidian
   OBSIDIAN_URL: "http://obsidian-server.poimen.svc.cluster.local:8080"
+  # LLM Configuration (for entity extraction)
+  LLM_ENDPOINT: "http://api-internal.riotpiao.com:8000/v1/chat/completions"
+  LLM_MODEL: "qwen:7b"
+  LLM_TIMEOUT_SECS: "30"
+  ENABLE_LLM_EXTRACTION: "true"

k8s/app/deployment.yaml

@@ -29,7 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: memory
-          image: forgejo.riotpiao.com/rock/poimen-memory:latest
+          image: forgejo.riotpiao.com/riotpiao-poimen/poimen-memory:latest
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
@@ -76,6 +76,8 @@ spec:
                 name: poimen-memory-config
             - secretRef:
                 name: poimen-memory-auth
+            - secretRef:
+                name: poimen-memory-secrets
           args:
             - serve
             - --port

k8s/app/memory-agent-secrets.enc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: memory-agent-auth
+    namespace: poimen
+type: Opaque
+stringData:
+    CLIENT_ID: ENC[AES256_GCM,data:qeGqSfcR8mUIkQRd4A==,iv:JZx+tR3Z9Mm8KLJqE8CfGZfZ0q+PdJKJLGT5bOKLjno=,tag:mYpvF5X/+cHXdm8vxqr5dA==,type:str]
+    CLIENT_SECRET: ENC[AES256_GCM,data:8nC3VGevMxzHb0EQeZZ+qEjppZrpNH8lrVBrYTJvVCEqb1gK6lKr4w==,iv:gZUVn+x7K3qHXYYxRTJQzVEZoQkkM1D6yPjFXCK0AWo=,tag:4I8p6LYc1vvNHxUmvVLQCQ==,type:str]
+    TOKEN_URL: ENC[AES256_GCM,data:jlpHwzKNFKlpMJTfPGCDgQS3kWb4pqAVEGJccJzq+xCPXo0=,iv:kX4D6ydoL6V/5V5g1Kzb8PwBZGKvQJZHmxQPRAcVLdo=,tag:sKGCwL3XcWG9sKZqKlEi8g==,type:str]
+    AUTHENTIK_ISSUER: ENC[AES256_GCM,data:ILkQfNBfZ/7L6s7Oy6dE/xRpB91qP23fKHC2Q0IzDxA=,iv:J+2mPqfKmfVaXI0L5cC3j8KhXjcPTMiZaZYvZZEhKFA=,tag:nG3g7FJ4jRgPXhCDzCzXEQ==,type:str]
+    AUTHENTIK_AUDIENCE: ENC[AES256_GCM,data:4d8nw7Mf2Yg=,iv:eEKzB8d6fC1Z+6JMRZ/tWPcQfbOGLFvLwP1B68n3OqI=,tag:WTKJmgXp8WEqJLfz7AQfIw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHSmt6SzRWSENWdFdN
+            L1o4TDZGdlY1UzVZVld1SXU1eHR3RENKSUZGYXdVCnlQQUwwUkxQa1pQRjhE
+            TDM1b2pxRjE5WmRKd3oxZGpkdm1FVkxRaXcKLT4gAhagIFqyQ1hpIVg6
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-30T15:43:00Z"
+    mac: ENC[AES256_GCM,data:REDACTED,iv:REDACTED,tag:REDACTED,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

k8s/app/poimen-memory-secrets.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: poimen-memory-auth
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: poimen-memory
+type: Opaque
+stringData:
+  # Authentik Service Account - OAuth2 client credentials
+  # These are obtained from Authentik admin panel:
+  # Settings → Applications → poimen-memory → Service Account
+  AUTHENTIK_ISSUER: "https://authentik.riotpiao.com/application/o/memory"
+  AUTHENTIK_AUDIENCE: "poimen-memory"
+  AUTHENTIK_CLIENT_ID: "${AUTHENTIK_SERVICE_ACCOUNT_CLIENT_ID}"
+  AUTHENTIK_CLIENT_SECRET: "${AUTHENTIK_SERVICE_ACCOUNT_SECRET}"
+  
+  # LLM API Key
+  # Generated by Authentik service account with permissions to LLM gateway
+  LLM_API_KEY: "${LLM_API_KEY_FROM_AUTHENTIK}"
+  
+  # S3 Credentials for backups (Velero)
+  S3_ACCESS_KEY: "${MINIO_ACCESS_KEY}"
+  S3_SECRET_KEY: "${MINIO_SECRET_KEY}"