ci: build and release webdrop-api and webdrop-files as separate images [CI]

- dev images are built only when the push touched code that image uses (path filters);
  webdrop-files does not wait for the frontend build
- one v* tag releases both images (:tag and :latest) after the shared checks
- registry build and push live in scripts/ci-publish-image.sh, used by every workflow
- containers: fix the api Containerfile (missing Sync project), add Containerfile.files,
  Quadlet units for the file service (prod and dev), env examples, and registry
  auto-update for the production units so each machine pulls only the image it runs

.woodpecker/release.yml

@@ -0,0 +1,65 @@
+# 发布:打 vMAJOR.MINOR.PATCH tag(或手动运行并传 RELEASE_TAG)。
+# 一个 tag 同时发布两个镜像:webdrop-api:<tag> / :latest 和 webdrop-files:<tag> / :latest。
+# 两边共用票据格式和文件协议,版本号一致最不容易配错;各机器只会拉自己用的那个镜像。
+when:
+  - event: tag
+    ref: refs/tags/v*
+  - event: manual
+
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: woodpeckerci/plugin-git:2.9.3
+    settings:
+      remote:
+        from_secret: gitea_clone_webdrop
+      lfs: false
+
+steps:
+  checkout-release-source:
+    image: bash
+    commands:
+      - set -euo pipefail
+      - release_tag="${CI_COMMIT_TAG:-${RELEASE_TAG:-}}"
+      - test -n "$release_tag"
+      - node scripts/check-api-contract.mjs "$release_tag"
+      - git fetch --force origin "refs/tags/$release_tag:refs/tags/$release_tag"
+      - git checkout --detach "refs/tags/$release_tag"
+
+  release-checks:
+    image: bash
+    commands:
+      - release_tag="${CI_COMMIT_TAG:-${RELEASE_TAG:-}}"
+      - test -n "$release_tag"
+      - node scripts/check-api-contract.mjs "$release_tag"
+      - bash scripts/ci-frontend.sh
+      - mkdir -p "$HOME/.cache/woodpecker/webdrop/nuget"
+      - NUGET_PACKAGES="$HOME/.cache/woodpecker/webdrop/nuget" dotnet restore server/WebDrop.slnx
+      - NUGET_PACKAGES="$HOME/.cache/woodpecker/webdrop/nuget" dotnet test server/WebDrop.slnx --configuration Release --verbosity minimal --no-restore
+
+  publish-api:
+    image: bash
+    depends_on: [release-checks]
+    environment:
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      ZOT_REGISTRY: registry.oeo.one
+    commands:
+      - release_tag="${CI_COMMIT_TAG:-${RELEASE_TAG:-}}"
+      - bash scripts/ci-publish-image.sh webdrop-api server/Containerfile "$release_tag" latest
+
+  publish-files:
+    image: bash
+    depends_on: [release-checks]
+    environment:
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+      ZOT_REGISTRY: registry.oeo.one
+    commands:
+      - release_tag="${CI_COMMIT_TAG:-${RELEASE_TAG:-}}"
+      - bash scripts/ci-publish-image.sh webdrop-files server/Containerfile.files "$release_tag" latest