refactor: reorganize CI/CD pipelines into separate workflow files

BREAKING CHANGE: Monolithic ci.yml split into focused pipeline files

## Pipeline Reorganization

Split single CI/CD pipeline into 7 specialized workflows:

1. **lint.yml** - Code quality checks (Black, Ruff, MyPy)
2. **test.yml** - Test suite with coverage reporting
3. **security.yml** - Security scanning (Bandit)
4. **build.yml** - Docker image builds and registry push
5. **deploy-staging.yml** - Staging environment deployment
6. **deploy-production.yml** - Production deployment (tags only)
7. **docs-generation.yml** - Scheduled documentation generation

## Benefits

- **Modularity**: Each pipeline has single responsibility
- **Performance**: Workflows run independently, faster feedback
- **Clarity**: Easier to understand and maintain
- **Flexibility**: Trigger pipelines independently
- **Debugging**: Isolated failures easier to diagnose

## Dockerfile Improvements

- Fix FROM AS casing (was 'as', now 'AS') in all Dockerfiles
- Resolves Docker build warnings
- Improves consistency across build files

## Documentation

- Added .gitea/workflows/README.md with:
  - Workflow descriptions and triggers
  - Dependency diagram
  - Environment variables reference
  - Troubleshooting guide
  - Best practices

## Migration Notes

- Old monolithic pipeline backed up as ci.yml.old
- All triggers preserved from original pipeline
- No changes to build or deploy logic
- Same environment variables and secrets required

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/security.yml

@@ -0,0 +1,51 @@
+# Security Scanning
+
+name: Security
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly on Monday
+
+env:
+  POETRY_VERSION: 1.8.0
+  PYTHON_VERSION: "3.12"
+
+jobs:
+  security:
+    name: Security Scanning
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install Poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Install dependencies
+        run: |
+          poetry config virtualenvs.in-project true
+          poetry install
+
+      - name: Run Bandit
+        run: |
+          poetry run bandit -r src/ -f json -o bandit-report.json
+        continue-on-error: true
+
+      - name: Upload Bandit report
+        uses: actions/upload-artifact@v4
+        with:
+          name: bandit-report
+          path: bandit-report.json
+        continue-on-error: true