build(deploy): build images on the server instead of publishing to a registry

- deploy/compose.yaml: every app service has `build:` (repo root context),
  local tags pipu-music-<service>:<version>
- deploy/update.sh: git fetch → checkout tag (latest release by default,
  or vX.Y.Z / main) → docker compose build --pull → up -d → prune → /readyz;
  re-executes from a temp copy because checkout may replace the script
- install.sh / .env.example: no REGISTRY, PIPU_VERSION set by update.sh,
  .env owned by the invoking user
- release.yml: drop image publishing; release ships APK + sha256 only
- ci.yml: new `docker` job builds all images without push
- docs: install guide uses git clone, deployment/ci-cd updated, ADR-013

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -73,6 +73,27 @@ jobs:
       - run: pnpm test
       - run: pnpm --filter @pipu/web build
 
+  docker:
+    name: docker (образы собираются — их сервер собирает сам при обновлении)
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - { name: api,           dockerfile: services/api/Dockerfile,         target: api }
+          - { name: storage-agent, dockerfile: services/api/Dockerfile,         target: storage-agent }
+          - { name: recommender,   dockerfile: services/recommender/Dockerfile, target: "" }
+          - { name: web,           dockerfile: apps/web/Dockerfile,             target: "" }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          target: ${{ matrix.target }}
+          push: false
+          build-args: VERSION=ci
+
   mobile:
     name: mobile (Metro-бандл Android)
     runs-on: ubuntu-latest

.gitea/workflows/release.yml

@@ -1,10 +1,7 @@
-# Релиз по тегу vMAJOR.MINOR.PATCH[-rc.N] (docs/ci-cd.md):
-# проверки → Docker-образы в Gitea Container Registry → подписанный APK → Gitea Release с ассетами.
+# Релиз по тегу vMAJOR.MINOR.PATCH[-rc.N] (docs/ci-cd.md): проверки → подписанный APK → Gitea Release.
+# Docker-образы не публикуются: сервер собирает их сам из клонированного репозитория (deploy/update.sh).
 #
-# Переменные репозитория (Settings → Actions → Variables):
-#   REGISTRY       — хост реестра, например git.home.lan (по умолчанию — хост сервера Gitea)
 # Секреты (Settings → Actions → Secrets):
-#   REGISTRY_USER, REGISTRY_TOKEN   — push образов (scope: write:package)
 #   RELEASE_TOKEN                   — создание релиза и загрузка ассетов (scope: write:repository)
 #   ANDROID_KEYSTORE_BASE64, ANDROID_KEYSTORE_PASSWORD, ANDROID_KEY_ALIAS, ANDROID_KEY_PASSWORD — подпись APK
 name: release
@@ -45,47 +42,9 @@ jobs:
       - name: TypeScript
         run: pnpm i18n:check && pnpm test:scripts && pnpm typecheck && pnpm test
 
-  images:
-    needs: verify
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - { name: api,           dockerfile: services/api/Dockerfile,         target: api }
-          - { name: storage-agent, dockerfile: services/api/Dockerfile,         target: storage-agent }
-          - { name: recommender,   dockerfile: services/recommender/Dockerfile, target: "" }
-          - { name: web,           dockerfile: apps/web/Dockerfile,             target: "" }
-    steps:
-      - uses: actions/checkout@v4
-      - name: Имя образа
-        id: img
-        run: |
-          registry="${{ vars.REGISTRY }}"
-          [ -n "$registry" ] || registry="$(echo '${{ github.server_url }}' | sed -E 's#^https?://##')"
-          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
-          echo "registry=$registry" >> "$GITHUB_OUTPUT"
-          echo "image=$registry/$owner/pipu-music-${{ matrix.name }}" >> "$GITHUB_OUTPUT"
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ steps.img.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ${{ matrix.dockerfile }}
-          target: ${{ matrix.target }}
-          push: true
-          build-args: VERSION=${{ needs.verify.outputs.version }}
-          tags: |
-            ${{ steps.img.outputs.image }}:${{ needs.verify.outputs.version }}
-            ${{ needs.verify.outputs.prerelease == 'false' && format('{0}:latest', steps.img.outputs.image) || '' }}
-
   android-release:
     name: android + release
-    needs: [verify, images]
+    needs: verify
     runs-on: ubuntu-latest
     env:
       PIPU_VERSION: ${{ needs.verify.outputs.version }}
@@ -159,7 +118,7 @@ jobs:
             '{tag_name:$tag, name:$name, body:$notes, prerelease:$pre, draft:false}')"
           id="$(curl -fsS -X POST -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
             -d "$body" "$API/releases" | jq -r .id)"
-          for f in "$APK" "$APK.sha256" deploy/compose.yaml deploy/compose.tls.yaml deploy/Caddyfile deploy/.env.example deploy/install.sh deploy/update.sh; do
+          for f in "$APK" "$APK.sha256"; do
             curl -fsS -X POST -H "Authorization: token $TOKEN" \
               -F "attachment=@$f" "$API/releases/$id/assets?name=$(basename "$f")" > /dev/null
             echo "uploaded $(basename "$f")"