feat: build and publish the gateway image via Forgejo Actions

- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit
  SHA stamped via VERSION build arg.
- .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the
  runner declares only the "docker" label. Verify job on every push; image
  build and push gated to main.
- Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran.
- deployment.yaml: image from the Forgejo registry, forgejo-registry pull
  secret, runAsUser 65532 to match distroless nonroot.
- kustomization.yaml: pin the tag in one place. Promoting a build is a
  one-line newTag bump, never :latest.

k8s/deployment.yaml

@@ -27,14 +27,22 @@ spec:
         prometheus.io/path: "/metrics"
     spec:
       serviceAccountName: api-gateway
+      # The registry at forgejo.riotpiao.com requires auth — /v2/ answers 401.
+      # This Secret must exist in the api namespace before the first rollout.
+      imagePullSecrets:
+      - name: forgejo-registry
       securityContext:
         runAsNonRoot: true
-        runAsUser: 1000
-        fsGroup: 1000
+        # 65532 is distroless's nonroot user, matching USER in the Dockerfile.
+        runAsUser: 65532
+        fsGroup: 65532
       containers:
       - name: gateway
-        image: ghcr.io/riotpiaole/api-gateway:latest
-        imagePullPolicy: Always
+        # Tag is pinned in kustomization.yaml so there is exactly one place to
+        # bump it. Never :latest — Argo cannot make a deterministic rollout
+        # decision from a mutable tag, and 6.1 requires SHA tags.
+        image: forgejo.riotpiao.com/rock/api-gateway
+        imagePullPolicy: IfNotPresent
         ports:
         - name: http
           containerPort: 8080
@@ -81,7 +89,7 @@ spec:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
           runAsNonRoot: true
-          runAsUser: 1000
+          runAsUser: 65532
           capabilities:
             drop:
             - ALL

k8s/kustomization.yaml

@@ -10,6 +10,15 @@ resources:
 - network-policy.yaml
 - configmap.yaml
 
+# The deployed image tag lives here and nowhere else. CI publishes
+# forgejo.riotpiao.com/rock/api-gateway:<commit-sha>; promoting a build is a
+# one-line commit bumping newTag, which Argo then syncs (G7).
+#
+#   kustomize edit set image forgejo.riotpiao.com/rock/api-gateway=:<sha>
+images:
+- name: forgejo.riotpiao.com/rock/api-gateway
+  newTag: REPLACE_WITH_FIRST_BUILD_SHA
+
 commonLabels:
   app: api-gateway
   managed-by: argocd