ci(tradein): build+push tradein-browser image in deploy workflow (#905)

The new browser service references ghcr.io/lekss361/gendesign-tradein-browser;
without a build job the deploy's compose-up would fail pulling a missing image.
Adds build-browser job (mirrors build-backend, context ./tradein-mvp/browser),
a browser path-filter (tradein-mvp/browser/**), IMAGE_BROWSER env, and wires
build-browser into deploy needs + the no-failure gate.

Refs #905

.forgejo/workflows/deploy-tradein.yml

@@ -18,6 +18,7 @@ concurrency:
 env:
   IMAGE_BACKEND: ghcr.io/lekss361/gendesign-tradein-backend
   IMAGE_FRONTEND: ghcr.io/lekss361/gendesign-tradein-frontend
+  IMAGE_BROWSER: ghcr.io/lekss361/gendesign-tradein-browser
 
 jobs:
   changes:
@@ -25,6 +26,7 @@ jobs:
     outputs:
       backend: ${{ steps.filter.outputs.backend }}
       frontend: ${{ steps.filter.outputs.frontend }}
+      browser: ${{ steps.filter.outputs.browser }}
       infra: ${{ steps.filter.outputs.infra }}
     steps:
       - uses: actions/checkout@v4
@@ -36,6 +38,8 @@ jobs:
               - 'tradein-mvp/backend/**'
             frontend:
               - 'tradein-mvp/frontend/**'
+            browser:
+              - 'tradein-mvp/browser/**'
             infra:
               - 'tradein-mvp/docker-compose.prod.yml'
               - 'tradein-mvp/deploy/**'
@@ -149,9 +153,41 @@ jobs:
             ${{ env.IMAGE_FRONTEND }}:latest
             ${{ env.IMAGE_FRONTEND }}:${{ github.sha }}
 
+  build-browser:
+    runs-on: ubuntu-latest
+    needs: changes
+    # tradein-browser несёт camoufox + Firefox-build (#905). Триггерится на
+    # изменения browser/ или infra (compose ссылается на образ) или вручную.
+    if: |
+      needs.changes.outputs.browser == 'true' ||
+      needs.changes.outputs.infra == 'true' ||
+      github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to GHCR (shell-based — docker/login-action@v3 unreliable под Forgejo Actions)
+        env:
+          GHCR_PAT: ${{ secrets.GHCR_PAT }}
+        run: |
+          echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build & push tradein-browser
+        uses: docker/build-push-action@v6
+        with:
+          context: ./tradein-mvp/browser
+          push: true
+          cache-from: type=registry,ref=${{ env.IMAGE_BROWSER }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE_BROWSER }}:buildcache,mode=max
+          tags: |
+            ${{ env.IMAGE_BROWSER }}:latest
+            ${{ env.IMAGE_BROWSER }}:${{ github.sha }}
+
   deploy:
     runs-on: ubuntu-latest
-    needs: [changes, test, build-backend, build-frontend]
+    needs: [changes, test, build-backend, build-frontend, build-browser]
     # NB: a failed `test` skips build-backend (result='skipped', not 'failure'),
     # so we must block deploy on test failure explicitly (#666 quality gate).
     if: |
@@ -159,7 +195,8 @@ jobs:
       !cancelled() &&
       needs.test.result != 'failure' &&
       needs.build-backend.result != 'failure' &&
-      needs.build-frontend.result != 'failure'
+      needs.build-frontend.result != 'failure' &&
+      needs.build-browser.result != 'failure'
     steps:
       - name: Deploy via SSH
         uses: appleboy/ssh-action@v1.0.3