ci(docker): publish image to Gitea registry (dev + main), mirror AegisGitea-MCP

Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline:
lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe.

- Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev ->
  :dev, every build also tagged :sha-<12>. Push gated to main/dev push events,
  authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run.
- docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest)
  with local build as a fallback; .env.example + docs/deployment.md document the
  channels and the pull-based deploy.

docker-compose.yml

@@ -1,9 +1,12 @@
 services:
   familiar:
+    # Pull the image published to Gitea by .gitea/workflows/docker.yml.
+    # Override the tag via .env: FAMILIAR_IMAGE (:latest / :main for prod, :dev
+    # for the dev channel). `docker compose build` still rebuilds it locally.
+    image: ${FAMILIAR_IMAGE:-git.hiddenden.cafe/hiddenden/familiar:latest}
     build:
       context: .
       dockerfile: docker/Dockerfile
-    image: familiar:latest
     container_name: familiar
     restart: unless-stopped
     env_file: