feat: build and publish the gateway image via Forgejo Actions

- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit
  SHA stamped via VERSION build arg.
- .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the
  runner declares only the "docker" label. Verify job on every push; image
  build and push gated to main.
- Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran.
- deployment.yaml: image from the Forgejo registry, forgejo-registry pull
  secret, runAsUser 65532 to match distroless nonroot.
- kustomization.yaml: pin the tag in one place. Promoting a build is a
  one-line newTag bump, never :latest.

k8s/kustomization.yaml

@@ -10,6 +10,15 @@ resources:
 - network-policy.yaml
 - configmap.yaml
 
+# The deployed image tag lives here and nowhere else. CI publishes
+# forgejo.riotpiao.com/rock/api-gateway:<commit-sha>; promoting a build is a
+# one-line commit bumping newTag, which Argo then syncs (G7).
+#
+#   kustomize edit set image forgejo.riotpiao.com/rock/api-gateway=:<sha>
+images:
+- name: forgejo.riotpiao.com/rock/api-gateway
+  newTag: REPLACE_WITH_FIRST_BUILD_SHA
+
 commonLabels:
   app: api-gateway
   managed-by: argocd