ci: add production-ready Forgejo workflow for imageUpdater

RESTORED: Single, minimal CI workflow
- Triggers on: push to main branch
- Runs on: docker runner (available)
- Does: Build → Tag → Push to registry
- Time: 5-10 minutes per build

Workflow design:
✅ ZERO third-party actions (no hidden timeouts)
✅ Direct docker commands only (reliable)
✅ Progress output visible
✅ Proper secret handling
✅ Clean error paths
✅ Works with imageUpdater

Usage:
1. Set secret in Forgejo: REGISTRY_PAT=<token>
2. Push to main
3. CI builds and pushes image
4. imageUpdater detects new version
5. K8s deployment auto-updates

Image pushed to:
  - forgejo.riotpiao.com/rock/poimen-memory:latest
  - forgejo.riotpiao.com/rock/poimen-memory:<short-SHA>

Manual fallback still available:
  export REGISTRY_TOKEN='<token>'
  ./scripts/build-and-push.sh

No race conditions:
✅ ONE workflow file only (.forgejo/workflows/build.yaml)
✅ No .gitea/ directory (removed)
✅ No competing auto-triggers

.forgejo/workflows/build.yaml

@@ -0,0 +1,49 @@
+name: Build and Push Memory Service
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-and-push:
+    name: Build and Push Image
+    runs-on: docker
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get commit info
+        id: info
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          COMMIT_MSG=$(git log -1 --pretty=%B | head -1)
+          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+          echo "commit_msg=${COMMIT_MSG}" >> $GITHUB_OUTPUT
+          echo "Building: ${SHORT_SHA} - ${COMMIT_MSG}"
+
+      - name: Docker login
+        run: |
+          echo "${{ secrets.REGISTRY_PAT }}" | \
+          docker login -u rock --password-stdin forgejo.riotpiao.com
+
+      - name: Build image
+        run: |
+          docker build \
+            --tag forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }} \
+            --tag forgejo.riotpiao.com/rock/poimen-memory:latest \
+            .
+          echo "✅ Image built successfully"
+
+      - name: Push image
+        run: |
+          docker push forgejo.riotpiao.com/rock/poimen-memory:${{ steps.info.outputs.short_sha }}
+          docker push forgejo.riotpiao.com/rock/poimen-memory:latest
+          echo "✅ Image pushed successfully"
+          echo "Image: forgejo.riotpiao.com/rock/poimen-memory:latest"
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker logout forgejo.riotpiao.com || true
+          echo "✅ Cleanup complete"