ci(deploy): publish images via Gitea Registry and verify on CD

CI workflows now own image publishing: backend-ci and frontend-ci push
service images to the Gitea Registry tagged with commit8. CD workflows
(nas-compose-deploy, nas-compose-service-deploy, offline-package, the
new nas-k3s-deploy) pull and verify those tags instead of rebuilding,
so deployments fail fast when CI hasn't produced the matching image.
The shared deploy/scripts/gitea-registry-images.sh helper drives both
the ensure (CI) and verify (CD) paths, and package.sh can now hydrate
its local images from the registry via SOURCE_IMAGE_REGISTRY.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/frontend-ci.yml

@@ -5,8 +5,12 @@ on:
     branches:
       - main
     paths:
-      - "apps/**"
+      - "apps/admin-web/**"
+      - "apps/ops-web/**"
       - "packages/**"
+      - "Dockerfile.frontend"
+      - "Dockerfile.ops-web"
+      - ".dockerignore"
       - "package.json"
       - "pnpm-lock.yaml"
       - "pnpm-workspace.yaml"
@@ -14,8 +18,12 @@ on:
     branches:
       - main
     paths:
-      - "apps/**"
+      - "apps/admin-web/**"
+      - "apps/ops-web/**"
       - "packages/**"
+      - "Dockerfile.frontend"
+      - "Dockerfile.ops-web"
+      - ".dockerignore"
       - "package.json"
       - "pnpm-lock.yaml"
       - "pnpm-workspace.yaml"
@@ -51,11 +59,35 @@ jobs:
       - name: Typecheck ops web
         run: pnpm --filter ops-web typecheck
 
-      - name: Typecheck browser extension
-        run: pnpm typecheck:extension
-
       - name: Build admin web
         run: pnpm build:admin
 
       - name: Build ops web
         run: pnpm --filter ops-web build
+
+      - name: Install Docker CLI
+        if: github.event_name != 'pull_request'
+        run: |
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+          apt-get update
+          apt-get install -y docker.io
+
+      - name: Publish frontend images
+        if: github.event_name != 'pull_request'
+        env:
+          REGISTRY_HOST: 192.168.100.19:13000
+          REGISTRY_OWNER: root
+          REGISTRY_IMAGE_PREFIX: geo-rankly
+          REGISTRY_USERNAME: root
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          REGISTRY_PLAIN_HTTP: "true"
+          IMAGE_LIST: frontend ops-web
+          DELETE_OLD_IMAGE_TAGS: "true"
+        run: |
+          set -eu
+          IMAGE_TAG="$(git rev-parse --short=8 HEAD)"
+          export IMAGE_TAG
+          bash deploy/scripts/gitea-registry-images.sh ensure