fix(deploy): keep last 2 SHA-tagged images per repo, drop older

Previously `docker image prune -af --filter until=72h` only removed
images older than 72h. With multiple deploys/day we accumulate many
fresh (<72h) tagged images — each gendesign-backend / worker / frontend
SHA-tag is 500MB-1GB, filling /var/lib/docker.

New logic: for each ghcr.io/lekss361/gendesign-* repo, list tags sorted
by Created DESC, skip :latest, keep top 2, remove the rest. Still runs
the standard prune after for dangling layers + build cache.

.github/workflows/deploy.yml

@@ -217,9 +217,21 @@ jobs:
             docker compose -p gendesign -f docker-compose.prod.yml exec -T caddy \
               caddy reload --config /etc/caddy/Caddyfile || true
 
-            # Clean up disk: dangling layers + tagged images older than 72h that
-            # nothing is using anymore. Plus build cache (we never build on prod
-            # but old buildkit caches may linger from earlier compose builds).
+            # Clean up disk:
+            # 1. Для каждого gendesign-* образа оставляем 2 самых свежих
+            #    SHA-тега (currently running + 1 fallback для rollback),
+            #    остальные удаляем независимо от возраста. `:latest`
+            #    никогда не трогаем. Docker images сортирует по Created
+            #    DESC по умолчанию — берём всё после первых 2 строк.
+            for repo in ghcr.io/lekss361/gendesign-backend \
+                        ghcr.io/lekss361/gendesign-worker \
+                        ghcr.io/lekss361/gendesign-frontend; do
+              docker images "$repo" --format '{{.Repository}}:{{.Tag}}' \
+                | grep -v ':latest$' \
+                | tail -n +3 \
+                | xargs -r docker rmi 2>/dev/null || true
+            done
+            # 2. dangling/unused images (untagged layers) + build cache.
             docker image prune -af --filter "until=72h" || true
             docker builder prune -af || true