feat(infrastructure): pull pre-built images from Gitea registry

migrate/api/worker/frontend now reference
git.devils.zone/devil/youtube-studio-flow-{backend,frontend}:\${IMAGE_TAG}
instead of building on the deploy host. Adds scripts/build-and-push.sh
to build+tag (git short SHA + latest) and push both images from a dev
machine, and updates infrastructure/README.md with the pull-based
deploy sequence.

infrastructure/.env.example

@@ -2,6 +2,12 @@
 # The public domain Traefik routes to this app (no https://, no trailing slash).
 DOMAIN=yourdomain.com
 
+# ─── Image tag ────────────────────────────────────────────────────────────────
+# Which tag to pull from git.devils.zone/devil/youtube-studio-flow-{backend,frontend}.
+# Pin to a git short SHA or release tag for reproducible deploys; `latest` tracks
+# whatever scripts/build-and-push.sh last pushed.
+IMAGE_TAG=latest
+
 # ─── Postgres ─────────────────────────────────────────────────────────────────
 POSTGRES_USER=studioflow
 POSTGRES_PASSWORD=change_me_strong_password