ci: optimize build + deploy + migrate workflows (#51)

## Optimize CI/CD Workflows

### Changes

#### build.yaml
- **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts
- **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### deploy.yaml
- **Skip checkout**: Removed unnecessary git clone
- **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning
- **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges)
- **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images)
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### migrate.yaml
- **Merge schema verification**: Schema inspect result reused in both changed + manual paths
- **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`)
- **Track failures**: Explicit FAILED flag tracks migration errors across loop

### Benefits

- **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts
- **Reliability**: Secret validation catches configuration issues early
- **Safety**: Image existence check prevents tagging phantom images
- **Clarity**: Merged steps have descriptive names, explicit error handling

### Testing

- Branch: `ci/optimize-workflows`
- Ready to merge to `main` after review

---------

Co-authored-by: rock <[email protected]>
Reviewed-on: #51
Co-authored-by: poimen <[email protected]>

Dockerfile

@@ -5,14 +5,23 @@ FROM rust:1-bookworm as builder
 
 WORKDIR /build
 
+# Build settings
+ENV SQLX_OFFLINE=true
+
 # Copy source
 COPY . .
 
-# Build the mem binary (offline sqlx - uses .sqlx/ cache)
-ENV SQLX_OFFLINE=true
-RUN cargo build --release -p mem-cli && \
+# Build release binary with space-efficient cleanup
+RUN cargo build --release -p mem-cli --locked && \
     strip target/release/mem && \
-    rm -rf target/release/deps target/release/build target/release/incremental target/release/.fingerprint
+    # Aggressive cleanup to free disk space
+    rm -rf target/release/deps && \
+    rm -rf target/release/build && \
+    rm -rf target/release/incremental && \
+    rm -rf target/release/.fingerprint && \
+    rm -rf .cargo/registry/cache && \
+    rm -rf .cargo/registry/index && \
+    rm -rf .cargo/git
 
 # Stage 2: Runtime
 FROM debian:bookworm-slim