refactor: consolidate workflows and rename to .yaml extension

- Renamed test.yml → test.yaml
- Renamed production.yml → production.yaml
- Split build.yaml into staging.yaml (Dokku only)
- Removed duplicate production build from build.yaml

Production deployments now use production.yaml which includes:
- Test gates (ExUnit + e2e tests must pass)
- Docker build and push
- k8s deployment.yaml update
- FluxCD auto-deployment

Staging deployments use staging.yaml:
- Deploys to Dokku on push to main
- No test gates (tests run via test.yaml)

This eliminates the duplicate production builds that were running
from both build.yaml and production.yml simultaneously.

.forgejo/workflows/build.yaml

@@ -1,97 +0,0 @@
-name: Build and Deploy
-
-on:
-  push:
-    branches:
-      - main
-      - production
-
-env:
-  DOCKER_BUILDKIT: 1
-  DOCKER_TLS_CERTDIR: ""
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  deploy-staging:
-    name: Deploy to Dokku Staging
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Full history needed for Dokku
-
-      - name: Deploy to Dokku
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.DOKKU_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H 204.110.191.231 >> ~/.ssh/known_hosts
-          # Clear stale deploy lock from cancelled runs
-          ssh dokku@204.110.191.231 apps:unlock towerops || true
-          git remote add dokku dokku@204.110.191.231:towerops || true
-          git push dokku main:main --force
-
-  build-production:
-    name: Build and Deploy to Production
-    if: github.ref == 'refs/heads/production'
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          buildkitd-config-inline: |
-            [registry."docker.io"]
-              mirrors = ["docker-mirror.mcintire.me"]
-
-      - name: Log in to container registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.REGISTRY_URL }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Extract metadata
-        id: meta
-        run: |
-          TIMESTAMP=$(date +%s)
-          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-          IMAGE=${{ secrets.REGISTRY_URL }}/${{ github.repository }}
-          echo "image=${IMAGE}" >> $GITHUB_OUTPUT
-          echo "tag=${IMAGE}:production-${TIMESTAMP}-${SHORT_SHA}" >> $GITHUB_OUTPUT
-          echo "latest_tag=${IMAGE}:latest" >> $GITHUB_OUTPUT
-          echo "cache_tag=${IMAGE}:buildcache" >> $GITHUB_OUTPUT
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: k8s/Dockerfile
-          push: true
-          tags: |
-            ${{ steps.meta.outputs.tag }}
-            ${{ steps.meta.outputs.latest_tag }}
-          cache-from: type=registry,ref=${{ steps.meta.outputs.cache_tag }}
-          cache-to: type=registry,ref=${{ steps.meta.outputs.cache_tag }},mode=max
-
-      - name: Update deployment image tag
-        run: |
-          sed -i "s|image: git\.mcintire\.me/graham/towerops-web:.*|image: ${{ steps.meta.outputs.tag }}|g" k8s/deployment.yaml
-          git config user.email "ci@git.mcintire.me"
-          git config user.name "CI"
-          git add k8s/deployment.yaml
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: update towerops-web image to ${{ steps.meta.outputs.tag }} [skip ci]"
-            # Pull with rebase to handle concurrent pushes
-            git pull --rebase origin production
-            git push origin HEAD:production
-          fi

.forgejo/workflows/staging.yaml

@@ -0,0 +1,39 @@
+name: Deploy to Staging
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  DOCKER_BUILDKIT: 1
+  DOCKER_TLS_CERTDIR: ""
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy-staging:
+    name: Deploy to Dokku Staging
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history needed for Dokku
+
+      - name: Deploy to Dokku
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.DOKKU_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 204.110.191.231 >> ~/.ssh/known_hosts
+          # Clear stale deploy lock from cancelled runs
+          ssh dokku@204.110.191.231 apps:unlock towerops || true
+          git remote add dokku dokku@204.110.191.231:towerops || true
+          git push dokku main:main --force
+