ci: GHCR deploy pipeline, production compose, Docker smoke tests

[mriechers]

Summary

• deploy.yml: Replace placeholder with full GHCR build+push workflow (api, web, worker images tagged with SHA + latest)
• docker-compose.prod.yml: Production compose file pulling from GHCR with Watchtower auto-updates (label-based opt-in)
• ci.yml: Add Docker build smoke test job to catch Dockerfile issues before merge

Details

Deploy workflow builds and pushes 3 images to ghcr.io/mriechers/cardigan-{api,web,worker} on merge to main. Uses deploy-specific GHA cache scopes to avoid collisions with CI cache.

Production compose mirrors the dev compose but uses image: instead of build:. Watchtower polls GHCR every 5 minutes and only updates containers labeled watchtower.enable=true (api, web, worker — not tunnel or third-party images).

Docker smoke test builds all 3 Dockerfiles with push: false on PRs to main and pushes to dev, ensuring Dockerfile changes don't break the build.

Test plan

• CI passes (lint, test, build, migration, Docker smoke test)
• deploy.yml YAML is valid
• docker-compose.prod.yml validates: docker compose -f docker-compose.prod.yml config
• Watchtower label opt-in correctly scoped to GHCR services only

🤖 Generated with Claude Code