ci: optimize build + deploy + migrate workflows (#51)

## Optimize CI/CD Workflows

### Changes

#### build.yaml
- **Merge 3 cargo steps → 1 compile pass**: `cargo build`, `cargo test`, `cargo clippy` now run in single invocation, reusing compiled artifacts
- **Remove `cargo clean`**: Eliminated wasteful step that deleted artifacts before Docker build
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### deploy.yaml
- **Skip checkout**: Removed unnecessary git clone
- **Fetch SHA via Gitea API**: Query latest commit directly instead of cloning
- **Reuse existing token**: Use `FORGEJO_REGISTRY_TOKEN` for Gitea API auth (already has privileges)
- **Validate image exists**: Check SHA image exists before tagging as latest (prevents tagging non-existent images)
- **Add secret validation**: Registry credentials checked before login (fail-fast)

#### migrate.yaml
- **Merge schema verification**: Schema inspect result reused in both changed + manual paths
- **Fix manual trigger errors**: Manual mode now fails on first migration error (was silently masking with `|| true`)
- **Track failures**: Explicit FAILED flag tracks migration errors across loop

### Benefits

- **Speed**: Fewer compiles, no unnecessary clones, reuse artifacts
- **Reliability**: Secret validation catches configuration issues early
- **Safety**: Image existence check prevents tagging phantom images
- **Clarity**: Merged steps have descriptive names, explicit error handling

### Testing

- Branch: `ci/optimize-workflows`
- Ready to merge to `main` after review

---------

Co-authored-by: rock <[email protected]>
Reviewed-on: #51
Co-authored-by: poimen <[email protected]>

k8s/app/config.yaml

@@ -1,5 +1,7 @@
-# Non-sensitive environment variables for poimen-memory
-# Change these without redeploying secrets.
+# Production environment configuration for poimen-memory
+# All services use cluster-internal DNS names
+# This file is encrypted with SOPS in production
+# For local dev, use plaintext version with external URLs
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -9,19 +11,39 @@ metadata:
     app.kubernetes.io/name: poimen-memory
     app.kubernetes.io/component: config
 data:
-  # Auth mode: jwt | apikey
-  MEM_AUTH_MODE: "none"
+  # Auth mode: jwt | apikey | none
+  MEM_AUTH_MODE: "jwt"
+  
   # Rate limiting
   MEM_RATE_LIMIT_INGEST: "100"
   MEM_RATE_LIMIT_QUERY: "1000"
   MEM_IDEMPOTENCY_TTL_SECS: "86400"
+  
   # Embeddings
   MEM_EMBEDDING_BATCH_SIZE: "32"
-  # OpenSearch
-  OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
-  # Obsidian
-  # LLM Configuration (for entity extraction)
-  LLM_ENDPOINT: "http://api-internal.riotpiao.com:8000/v1/chat/completions"
-  LLM_MODEL: "qwen:7b"
+  
+  # Downstream services - read by application from ENV
+  # Internal cluster DNS (prod) / external URLs (local)
+  
+  # LLM Service (entity extraction, fact extraction)
+  LLM_ENDPOINT: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1/chat/completions"
+  LLM_API_BASE: "http://reasoning-predictor.llm-serving.svc.cluster.local:8000/v1"
+  LLM_MODEL: "ornith:35b"
   LLM_TIMEOUT_SECS: "30"
   ENABLE_LLM_EXTRACTION: "true"
+  
+  # OpenSearch (vector store, BM25 retrieval)
+  OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
+  OPENSEARCH_SCHEME: "http"
+  OPENSEARCH_VERIFY_CERTS: "false"
+  
+  # Authentik (OIDC provider)
+  AUTHENTIK_ISSUER: "https://authentik.auth.svc.cluster.local:9443/application/o/poimen/"
+  AUTHENTIK_VERIFY_SSL: "false"
+  
+  # Temporal (workflow orchestration - future)
+  TEMPORAL_ENDPOINT: "temporal-frontend.temporal.svc.cluster.local:7233"
+  TEMPORAL_NAMESPACE: "poimen"
+  
+  # API Gateway (external queue, route optimization - future)
+  GATEWAY_URL: "http://api-gw.poimen.svc.cluster.local:8080"