Reference: riotpiao.com action run 496/707
Unified structure:
- test job: all branches + PRs
- build-push job: main push only, depends on test
- Install Node.js before checkout
- Install docker only in build-push
- Proper secrets and env handling
- Docker login + build + push + prune