Add version tag support to build workflow

Tag pushes (v*) now push an additional versioned image tag alongside
:latest and :<sha>. To release: git tag v1.2.0 && git push origin v1.2.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -1,19 +1,20 @@
-# Runs only on pushes to main.
+# Runs on pushes to main and on version tags (v*).
-# Builds the Docker image and pushes it to the Forgejo container registry.
-# Registry-side layer caching means unchanged layers (npm install, pip install)
-# are reused between builds — typically cuts build time from ~4 min to ~45 sec.
 #
-# The resulting image can then be deployed manually via Portainer.
+# Branch push (main):  builds and pushes :latest + :<sha>
+# Tag push (v1.2.0):   builds and pushes :latest + :<sha> + :v1.2.0
+#
+# To cut a versioned release:
+#   git tag v1.2.0 && git push origin v1.2.0
 #
 # Required secrets (repo → Settings → Secrets → Actions):
 #   REGISTRY_USER   — your Forgejo username
-#   REGISTRY_TOKEN  — Forgejo PAT with write:packages scope (create at
+#   REGISTRY_TOKEN  — Forgejo PAT with write:packages scope
-#                     git.fabledsword.com → Settings → Applications → Generate Token)
 name: Build & push image
 
 on:
   push:
     branches: [main]
+    tags: ["v*"]
     paths:
       - "src/**"
       - "frontend/**"
@@ -34,6 +35,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Generate image tags
+        id: tags
+        run: |
+          TAGS="${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.sha }}"
+          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            TAGS="$TAGS,${{ env.IMAGE }}:${{ github.ref_name }}"
+            echo "Releasing version ${{ github.ref_name }}"
+          fi
+          echo "value=$TAGS" >> $GITHUB_OUTPUT
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -49,8 +60,6 @@ jobs:
         with:
           context: .
           push: true
-          tags: |
+          tags: ${{ steps.tags.outputs.value }}
-            ${{ env.IMAGE }}:latest
-            ${{ env.IMAGE }}:${{ github.sha }}
           cache-from: type=registry,ref=${{ env.IMAGE }}:cache
           cache-to: type=registry,ref=${{ env.IMAGE }}:cache,mode=max