ci: revert to Docker image build + registry push (no deploy)

Drop the LXC deploy step. Pipeline now stops at publishing the image
to the Gitea registry; deployment is handled out of band.

Restored:
- Dockerfile (multi-stage: curl-builder + quarkus-micro-image:2.0,
  generic via build-output/*-runner wildcard, COPY --chown=1001:1001)
- compose.yaml (one-shot install of the published image)
- .dockerignore (excludes build-output/)

CI workflow:
- Installs docker-buildx (needed for COPY --chown)
- Uses docker buildx build
- chmod 775 and echo securerandom happen in the 'Stage binary for Docker'
  step; the final image has no RUN commands
- Tags :latest and :<short-sha>, pushes with retry

No deploy step. Pull the image with docker compose / run it manually.

.gitea/workflows/ci.yml

@@ -21,16 +21,18 @@ jobs:
       image: maven:3.9.6-eclipse-temurin-21
       options: --memory=8g
     steps:
-      - name: Install git, node, gcc, and basic tools
+      - name: Install git, node, gcc, docker, buildx, and basic tools
         run: |
           apt-get update
-          apt-get install -y git curl ca-certificates build-essential zlib1g-dev openssh-client
+          apt-get install -y git curl ca-certificates build-essential zlib1g-dev docker.io docker-buildx
           curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
           apt-get install -y nodejs
           rm -rf /var/lib/apt/lists/*
           git --version
           node --version
           gcc --version
+          docker --version
+          docker buildx version
 
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,20 +64,48 @@ jobs:
         run: mvn package -Pnative -B -DskipTests -Dquarkus.native.native-image-xmx=4g -Dquarkus.native.binary-type=STATIC
 
       - name: Verify native binary
-        run: ls -la target/shot-crafter-calculator-1.0.0-runner
+        run: |
+          ls -la target/shot-crafter-calculator-1.0.0-runner
 
-      - name: Deploy to LXC
+      - name: Stage binary for Docker
+        run: |
+          mkdir -p build-output
+          cp target/shot-crafter-calculator-1.0.0-runner build-output/
+          chmod 775 build-output/shot-crafter-calculator-1.0.0-runner
+          echo "securerandom.source=file:/dev/urandom" >> build-output/shot-crafter-calculator-1.0.0-runner
+
+      - name: Build & Push Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           set -e
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
-          chmod 0600 ~/.ssh/deploy_key
-          ssh-keyscan -H localhost >> ~/.ssh/known_hosts
-          ssh -i ~/.ssh/deploy_key deployer@localhost \
-            "mkdir -p /opt/shot-crafter-calculator/deploy"
-          scp -i ~/.ssh/deploy_key \
-            target/shot-crafter-calculator-1.0.0-runner \
-            deployer@localhost:/opt/shot-crafter-calculator/deploy/application
-          ssh -i ~/.ssh/deploy_key deployer@localhost \
-            "sudo /usr/local/bin/deploy-shot-crafter-calculator.sh"
+          echo "=== Build Docker image ==="
+          docker buildx build -t shot-crafter-calculator:ci .
+          echo "=== Login to Gitea Registry ==="
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.danielarroyo.cl -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
+          echo "=== Tag ==="
+          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest
+          docker tag shot-crafter-calculator:ci gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}
+
+          push_with_retry() {
+            local ref="$1"
+            local attempt=1
+            local max_attempts=3
+            while [ $attempt -le $max_attempts ]; do
+              echo "=== Push (attempt $attempt/$max_attempts): $ref ==="
+              if docker push "$ref"; then
+                return 0
+              fi
+              echo "::warning::Push of $ref failed, retrying in 15s..."
+              sleep 15
+              attempt=$((attempt + 1))
+            done
+            echo "::error::Push of $ref failed after $max_attempts attempts"
+            return 1
+          }
+
+          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:latest"
+          push_with_retry "gitea.danielarroyo.cl/proyectos/shot-crafter-calculator:${SHORT_SHA}"
+          echo "=== Logout ==="
+          docker logout gitea.danielarroyo.cl
+          echo "=== Done ==="