refactor: reorganize CI/CD pipelines into separate workflow files

BREAKING CHANGE: Monolithic ci.yml split into focused pipeline files

## Pipeline Reorganization

Split single CI/CD pipeline into 7 specialized workflows:

1. **lint.yml** - Code quality checks (Black, Ruff, MyPy)
2. **test.yml** - Test suite with coverage reporting
3. **security.yml** - Security scanning (Bandit)
4. **build.yml** - Docker image builds and registry push
5. **deploy-staging.yml** - Staging environment deployment
6. **deploy-production.yml** - Production deployment (tags only)
7. **docs-generation.yml** - Scheduled documentation generation

## Benefits

- **Modularity**: Each pipeline has single responsibility
- **Performance**: Workflows run independently, faster feedback
- **Clarity**: Easier to understand and maintain
- **Flexibility**: Trigger pipelines independently
- **Debugging**: Isolated failures easier to diagnose

## Dockerfile Improvements

- Fix FROM AS casing (was 'as', now 'AS') in all Dockerfiles
- Resolves Docker build warnings
- Improves consistency across build files

## Documentation

- Added .gitea/workflows/README.md with:
  - Workflow descriptions and triggers
  - Dependency diagram
  - Environment variables reference
  - Troubleshooting guide
  - Best practices

## Migration Notes

- Old monolithic pipeline backed up as ci.yml.old
- All triggers preserved from original pipeline
- No changes to build or deploy logic
- Same environment variables and secrets required

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -0,0 +1,61 @@
+# Build and Push Docker Images
+
+name: Build
+
+on:
+  push:
+    branches: [ main ]
+    tags:
+      - 'v*'
+
+env:
+  REGISTRY: ${{ vars.PACKAGES_REGISTRY }}
+  IMAGE_NAME: ${{ gitea.repository }}
+
+jobs:
+  build-and-push:
+    name: Build and Push Docker Images
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
+
+    strategy:
+      matrix:
+        component: [api, chat, worker, frontend]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ vars.PACKAGES_REGISTRY }}
+          username: ${{ secrets.USERNAME }}
+          password: ${{ secrets.TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ vars.PACKAGES_REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.component }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix={{branch}}-
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/docker/Dockerfile.${{ matrix.component }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ vars.PACKAGES_REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.component }}:buildcache
+          cache-to: type=registry,ref=${{ vars.PACKAGES_REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.component }}:buildcache,mode=max