ci(deploy): publish images via Gitea Registry and verify on CD

CI workflows now own image publishing: backend-ci and frontend-ci push
service images to the Gitea Registry tagged with commit8. CD workflows
(nas-compose-deploy, nas-compose-service-deploy, offline-package, the
new nas-k3s-deploy) pull and verify those tags instead of rebuilding,
so deployments fail fast when CI hasn't produced the matching image.
The shared deploy/scripts/gitea-registry-images.sh helper drives both
the ensure (CI) and verify (CD) paths, and package.sh can now hydrate
its local images from the registry via SOURCE_IMAGE_REGISTRY.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/backend-ci.yml

@@ -13,6 +13,8 @@ on:
       - "server/go.sum"
       - "server/Makefile"
       - "server/scripts/**"
+      - "server/Dockerfile"
+      - "server/.dockerignore"
   pull_request:
     branches:
       - main
@@ -25,6 +27,8 @@ on:
       - "server/go.sum"
       - "server/Makefile"
       - "server/scripts/**"
+      - "server/Dockerfile"
+      - "server/.dockerignore"
   workflow_dispatch:
 
 permissions:
@@ -68,3 +72,30 @@ jobs:
       - name: Build Go commands
         working-directory: server
         run: go build ./cmd/...
+
+      - name: Install Docker CLI
+        if: github.event_name != 'pull_request'
+        run: |
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+          apt-get update
+          apt-get install -y docker.io
+
+      - name: Publish backend images
+        if: github.event_name != 'pull_request'
+        env:
+          REGISTRY_HOST: 192.168.100.19:13000
+          REGISTRY_OWNER: root
+          REGISTRY_IMAGE_PREFIX: geo-rankly
+          REGISTRY_USERNAME: root
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          REGISTRY_PLAIN_HTTP: "true"
+          IMAGE_LIST: migrate tenant-api ops-api worker-generate kol-assist-worker scheduler
+          DELETE_OLD_IMAGE_TAGS: "true"
+        run: |
+          set -eu
+          IMAGE_TAG="$(git rev-parse --short=8 HEAD)"
+          export IMAGE_TAG
+          bash deploy/scripts/gitea-registry-images.sh ensure