- dev images are built only when the push touched code that image uses (path filters);
webdrop-files does not wait for the frontend build
- one v* tag releases both images (:tag and :latest) after the shared checks
- registry build and push live in scripts/ci-publish-image.sh, used by every workflow
- containers: fix the api Containerfile (missing Sync project), add Containerfile.files,
Quadlet units for the file service (prod and dev), env examples, and registry
auto-update for the production units so each machine pulls only the image it runs
