Fix CI/CD: use SSH-based build instead of Docker-in-Docker

act_runner doesn't reliably support docker/build-push-action.
Build the image on the staging server and push to registry from
there instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy-prod.yml

@@ -7,9 +7,6 @@ on:
         description: 'Release tag to deploy (e.g. v3.3.0)'
         required: true
 
-env:
-  IMAGE: git.adlee.work/alee/golfgame
-
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -20,19 +17,21 @@ jobs:
           host: ${{ secrets.PROD_HOST }}
           username: root
           key: ${{ secrets.DEPLOY_SSH_KEY }}
-          envs: IMAGE
           script: |
+            set -e
+            TAG="${{ github.event.inputs.tag }}"
+            IMAGE="git.adlee.work/alee/golfgame"
+
             cd /opt/golfgame
 
-            # Pull the same image that passed staging
-            docker login git.adlee.work -u ${{ secrets.REGISTRY_USER }} -p ${{ secrets.REGISTRY_TOKEN }}
-            docker pull $IMAGE:${{ github.event.inputs.tag }}
+            # Pull the image that passed staging
+            echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.adlee.work -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+            docker pull "$IMAGE:$TAG"
+            docker tag "$IMAGE:$TAG" golfgame-app:latest
 
-            # Tag it so compose uses it
-            docker tag $IMAGE:${{ github.event.inputs.tag }} golfgame-app:latest
-
-            # Update code (for compose file / env changes)
-            git fetch origin && git checkout ${{ github.event.inputs.tag }}
+            # Update code for compose/env changes
+            git fetch origin
+            git checkout "$TAG"
 
             # Restart app
             docker compose -f docker-compose.prod.yml up -d app
@@ -41,7 +40,7 @@ jobs:
             echo "Waiting for health check..."
             for i in $(seq 1 30); do
               if docker compose -f docker-compose.prod.yml ps app | grep -q "healthy"; then
-                echo "Production deploy successful — ${{ github.event.inputs.tag }}"
+                echo "Production deploy successful — $TAG"
                 exit 0
               fi
               sleep 2