feat(infrastructure): pull pre-built images from Gitea registry

migrate/api/worker/frontend now reference
git.devils.zone/devil/youtube-studio-flow-{backend,frontend}:\${IMAGE_TAG}
instead of building on the deploy host. Adds scripts/build-and-push.sh
to build+tag (git short SHA + latest) and push both images from a dev
machine, and updates infrastructure/README.md with the pull-based
deploy sequence.

infrastructure/docker-compose.yml

@@ -2,9 +2,7 @@ services:
 
   # Runs database migrations once before the API and worker start.
   migrate:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     command: npx prisma migrate deploy
     restart: "no"
     environment:
@@ -16,9 +14,7 @@ services:
       - app-network
 
   api:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     environment:
       NODE_ENV: production
@@ -57,9 +53,7 @@ services:
       - traefik-network
 
   worker:
-    build:
-      context: ../backend
-      dockerfile: Dockerfile
+    image: git.devils.zone/devil/youtube-studio-flow-backend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     command: node dist/worker.js
     environment:
@@ -84,11 +78,10 @@ services:
       - app-network
 
   frontend:
-    build:
-      context: ../frontend
-      dockerfile: Dockerfile
-      # NEXT_PUBLIC_API_URL defaults to /api/v1 in the Dockerfile — no override needed.
-      # The relative path works because Traefik serves both frontend and API on the same domain.
+    # NEXT_PUBLIC_API_URL is baked in at build time (scripts/build-and-push.sh uses the
+    # Dockerfile default, /api/v1) — the relative path works because Traefik serves both
+    # frontend and API on the same domain.
+    image: git.devils.zone/devil/youtube-studio-flow-frontend:${IMAGE_TAG:-latest}
     restart: unless-stopped
     labels:
       - "traefik.enable=true"