feat: load service adapters from ConfigMap, remove k8s API dependency

Adapters defined in config.yaml alongside routes and models.
Parsed by existing config loader, populated into registry at startup.
Removed: client-go deps, REST loader, informer, nginx proxy,
CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types).
Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.

.gitea/workflows/ci.yaml

@@ -1,19 +1,5 @@
-# Forgejo Actions CI — verification only (vet, test, build).
-# Build and push happens in build.yaml on main push.
-#
-# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/.
-# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com)
-# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run
-# row on push, not once, for any repo -- confirmed both from application logs
-# (silent, no error) and directly in the action_run table. A .gitea/workflows
-# file with an identical job spec fires immediately. .github/workflows also
-# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on
-# kmsvc-manage both got action_run rows despite matching no runner) -- so
-# .forgejo/workflows/ specifically appears unsupported on this instance/version,
-# not workflow detection being off in general.
-#
-# runs-on: golang -- the generic "docker" runner was retired in favor of
-# per-language runners (golang/node/rust), each with its own dind sidecar.
+# Single pipeline: verify → build → push.
+# One workflow per push, one concurrency group per branch.
 name: CI
 
 on:
@@ -22,18 +8,21 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/api-gateway
+
 jobs:
   verify:
-    name: Test, vet, build
+    name: Vet, test, build
     runs-on: golang
     container:
-      image: golang:1.25-bookworm
+      image: golang:1.26-bookworm
     steps:
-      # actions/checkout@v4 is a JS action -- Forgejo Actions execs it with
-      # `node`, which golang:1.25-bookworm doesn't ship. Without this the
-      # checkout step fails with "exec: node: executable file not found in
-      # $PATH" before any of the job's own steps run. Same fix already in use
-      # in kmsvc-manage's ci.yaml; carried over here.
       - name: install node (required by JS-based actions)
         run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
 
@@ -42,15 +31,53 @@ jobs:
       - name: go vet
         run: go vet ./...
 
-      # The race detector needs cgo, so this cannot run with CGO_ENABLED=0.
       - name: go test -race
         run: go test ./... -race
 
-      - name: Static build
+      - name: Static build (smoke)
         run: CGO_ENABLED=0 go build -trimpath -o gateway ./cmd/gateway
 
-      - name: govulncheck
+  push:
+    name: Build and push image
+    needs: verify
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: golang
+    container:
+      image: docker:27-cli
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
+    env:
+      DOCKER_HOST: tcp://localhost:2376
+      DOCKER_TLS_VERIFY: "1"
+      DOCKER_CERT_PATH: /docker-certs/client
+    steps:
+      - name: install node (required by JS-based actions)
+        run: apk add --no-cache nodejs git
+
+      - uses: actions/checkout@v4
+
+      - name: Get short SHA
+        id: sha
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
-        continue-on-error: true
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Registry login
+        run: |
+          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
+            --username rock --password-stdin
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Build image
+        run: |
+          docker build \
+            --build-arg "VERSION=${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            .
+
+      - name: Push image
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"