ci: optimize build + deploy + migrate workflows (#51)

## Optimize CI/CD Workflows

### Changes

#### build.yaml
- **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts
- **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### deploy.yaml
- **Skip checkout**: Removed unnecessary git clone
- **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning
- **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges)
- **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images)
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### migrate.yaml
- **Merge schema verification**: Schema inspect result reused in both changed + manual paths
- **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`)
- **Track failures**: Explicit FAILED flag tracks migration errors across loop

### Benefits

- **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts
- **Reliability**: Secret validation catches configuration issues early
- **Safety**: Image existence check prevents tagging phantom images
- **Clarity**: Merged steps have descriptive names, explicit error handling

### Testing

- Branch: `ci/optimize-workflows`
- Ready to merge to `main` after review

---------

Co-authored-by: rock <[email protected]>
Reviewed-on: #51
Co-authored-by: poimen <[email protected]>

.dockerignore

@@ -1,12 +1,55 @@
+# Git
 .git
 .gitignore
+.gitattributes
+
+# CI/CD
+.github
+.gitea
+.gitlab-ci.yml
+
+# Kubernetes
+k8s/
+helm/
+
+# Documentation
 *.md
-__pycache__
-*.pyc
-.env.local
-.venv
-venv/
-.pytest_cache
-.coverage
-htmlcov
+docs/
+
+# IDE
+.vscode
+.idea
+*.swp
+*.swo
+*~
+
+# OS
 .DS_Store
+Thumbs.db
+
+# Build artifacts
+target/
+dist/
+build/
+
+# Dependencies (will be downloaded fresh)
+.cargo/
+Cargo.lock.bak
+
+# Testing
+.coverage
+coverage/
+
+# Secrets
+.env
+.env.local
+.env.*.local
+
+# Archives
+*.tar
+*.tar.gz
+*.zip
+
+# Node (if any)
+node_modules/
+*.log