fix(ci): use POSIX case for tag selection so :dev actually pushes

Buried smoking gun: every CI run since the ci-python:3.14 migration
has silently failed to push the `:dev` tag. The build logs for commit
2a374d9 show:

    /var/run/act/workflow/tags.sh: 4: [[: not found
    /var/run/act/workflow/tags.sh: 6: [[: not found

act_runner invokes the workflow's `run:` block with `sh -e` (dash on
Debian-based ci-python:3.14, NOT bash). The original bash-only `[[ ]]`
syntax failed silently, the `:dev` tag never got appended to TAGS,
and only the SHA-tagged image was pushed. The `:dev` tag in the
registry has been stuck on whatever build last managed to push it —
likely back when CI ran on a bash-y Ubuntu runner before the migration.

This is why the deployed stack has been running a stale image despite
multiple successful "CI passed" runs: it pulls `:dev`, and `:dev` was
months out of date.

POSIX `case` is dash-compatible AND bash-compatible. Same intent
(decide which extra tags to append based on ref); no behaviour change
other than actually executing correctly.

This commit itself touches .forgejo/workflows/ci.yml, so it triggers
a fresh CI run that — for the first time in a while — should push
both :<sha> AND :dev. After this lands, redeploying the stack will
finally pull the recent code.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -154,15 +154,25 @@ jobs:
 
       - name: Generate image tags and version
         id: tags
+        # POSIX `case` instead of bash `[[ ]]` because act_runner invokes
+        # `sh -e` (dash on the ci-python:3.14 image, which has no bash on
+        # the default PATH for /bin/sh). Previous `[[ ]]` form failed
+        # silently — only the SHA tag got appended, so :dev / :latest
+        # never updated in the registry and the deployed stack kept
+        # pulling stale images. Verified via `[[: not found` lines in
+        # the runner log on commit 2a374d9.
         run: |
           TAGS="${{ env.IMAGE }}:${{ github.sha }}"
           BUILD_VERSION="dev"
-          if [[ "${{ github.ref }}" == "refs/heads/dev" ]]; then
-            TAGS="$TAGS,${{ env.IMAGE }}:dev"
-          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
-            TAGS="$TAGS,${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.ref_name }}"
-            BUILD_VERSION="${{ github.ref_name }}"
-          fi
+          case "${{ github.ref }}" in
+            refs/heads/dev)
+              TAGS="$TAGS,${{ env.IMAGE }}:dev"
+              ;;
+            refs/tags/*)
+              TAGS="$TAGS,${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.ref_name }}"
+              BUILD_VERSION="${{ github.ref_name }}"
+              ;;
+          esac
           echo "value=$TAGS" >> $GITHUB_OUTPUT
           echo "build_version=$BUILD_VERSION" >> $GITHUB_OUTPUT