ci(docker): publish image to Gitea registry (dev + main), mirror AegisGitea-MCP

Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline:
lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe.

- Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev ->
  :dev, every build also tagged :sha-<12>. Push gated to main/dev push events,
  authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run.
- docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest)
  with local build as a fallback; .env.example + docs/deployment.md document the
  channels and the pull-based deploy.

docs/deployment.md

@@ -64,15 +64,37 @@ cp ~/.local/share/familiar/{token.enc,key} ./data/
 The `/data` volume is mounted read-write so token refresh (which rotates the
 refresh token) and the audit log can persist.
 
+## Published images (Gitea)
+
+`.gitea/workflows/docker.yml` builds, smoke-tests, and pushes the image to the
+Gitea container registry on every push to `main`/`dev`:
+
+| Branch | Tags |
+|--------|------|
+| `main` | `git.hiddenden.cafe/hiddenden/familiar:latest`, `:main`, `:sha-<12>` |
+| `dev`  | `git.hiddenden.cafe/hiddenden/familiar:dev`, `:sha-<12>` |
+
+Pushing needs a Gitea PAT with `write:package` scope stored as the repo secret
+`REGISTRY_TOKEN` (the auto `GITEA_TOKEN` lacks package-write here). Pick the
+channel with `FAMILIAR_IMAGE` in `.env` (`:latest`/`:main` for prod, `:dev`).
+
 ## Run with Docker Compose
 
 ```bash
 cp .env.example .env
-# edit .env: set FAMILIAR_HTTP_AUTH_TOKEN (strong!), FAMILIAR_DOMAIN, cert resolver
+# edit .env: FAMILIAR_HTTP_AUTH_TOKEN (strong!), FAMILIAR_DOMAIN, cert resolver,
+#            FAMILIAR_IMAGE (:latest for prod, :dev for the dev channel)
 python -c "import secrets; print(secrets.token_urlsafe(32))"   # generate a token
 
 docker network create proxy   # once, if your reverse proxy doesn't own it yet
-docker compose up -d --build
+
+# Pull the published image (prod):
+docker login git.hiddenden.cafe
+docker compose pull && docker compose up -d
+
+# ...or build it locally instead:
+#   docker compose up -d --build
+
 docker compose logs -f familiar
 ```