fix: separate test and build-push jobs (#3)

## Problem

Monolithic test-build-push job runs all steps sequentially, with conditionals for push only on main. This makes it hard to see what failed and doesn't clearly separate concerns.

## Fix

Split into two jobs:
- **test**: Runs on all branches + PRs (go mod, vet, test, build binary)
- **build-push**: Runs only on main push after test passes

Move env vars to workflow level (cleaner, reused by both jobs).

## Result
- PRs: test job runs ✅ (no docker install, no registry push) ✅
- Main push: test → build-push → registry push ✅

---------

Co-authored-by: Test <[email protected]>
Reviewed-on: #3

.gitea/workflows/ci.yaml

@@ -4,14 +4,17 @@ on:
   push:
     branches: [main]
   pull_request:
+    branches: [main]
 
-jobs:
-  test-build-push:
-    runs-on: golang
 env:
   GOPRIVATE: forgejo.riotpiao.com
   REGISTRY: forgejo.riotpiao.com
   IMAGE: forgejo.riotpiao.com/rock/poimen-workflows
+
+jobs:
+  test:
+    name: Test
+    runs-on: golang
     steps:
       - name: Install Node.js for actions runtime
         run: apt-get update && apt-get install -y nodejs
@@ -31,22 +34,28 @@ jobs:
       - name: Build binary
         run: CGO_ENABLED=0 GOOS=linux go build -o /tmp/poimen-worker ./cmd/worker
 
+  build-push:
+    name: Build & Push Image
+    needs: test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: golang
+    steps:
+      - name: Install Node.js and Docker
+        run: apt-get update && apt-get install -y nodejs docker.io
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
       - name: Get short SHA
         id: sha
         run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
-      - name: Install Docker CLI
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        run: apt-get update && apt-get install -y docker.io
-
       - name: Registry login
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         run: |
           echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${REGISTRY}" \
             --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
 
       - name: Build and push image
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         run: |
           docker build \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \