ci: optimize build + deploy + migrate workflows

- build.yaml: merge 3 cargo steps into single compile pass (reuse artifacts)
- build.yaml: remove cargo clean (wasted compiled artifacts before Docker)
- build.yaml: add secret validation for registry credentials
- deploy.yaml: skip checkout, fetch SHA via Gitea API (no clone overhead)
- deploy.yaml: reuse FORGEJO_REGISTRY_TOKEN for API auth (existing privilege)
- deploy.yaml: validate SHA image exists before tagging as latest
- deploy.yaml: add secret validation for registry credentials
- migrate.yaml: merge schema verification into both changed + manual paths
- migrate.yaml: manual trigger now fails on first error (was silently masking)

.gitea/workflows/build.yaml

@@ -26,17 +26,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Cargo build all
-        run: cargo build --all --verbose
-
-      - name: Cargo test all
-        run: cargo test --all --lib --verbose 2>&1 | tail -150 || true
-
-      - name: Cargo clippy
-        run: cargo clippy --all --all-targets -- -D warnings 2>&1 | tail -50 || true
-
-      - name: Clean build artifacts before Docker
-        run: cargo clean
+      - name: Cargo build, test, clippy (single compile pass)
+        run: |
+          cargo build --all --verbose
+          cargo test --all --lib --verbose 2>&1 | tail -150 || true
+          cargo clippy --all --all-targets -- -D warnings 2>&1 | tail -50 || true
 
       - name: Get short SHA
         id: sha
@@ -44,6 +38,10 @@ jobs:
 
       - name: Registry login
         run: |
+          if [ -z "${REGISTRY_USER}" ] || [ -z "${REGISTRY_TOKEN}" ]; then
+            echo "ERROR: Missing REGISTRY_USER or REGISTRY_TOKEN secrets"
+            exit 1
+          fi
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
             --username "${REGISTRY_USER}" --password-stdin
         env: