fix: version bumping and Docker registry authentication (#17)

## Summary

This PR fixes the release workflow to properly handle version bumping on PR merge and uses the new Docker registry authentication secrets.

## Changes

### Release Workflow (release.yml)
- **Version Bumping**: Now automatically bumps version on PR merge
  - Determines bump type from commit messages (major/minor/patch)
  - Commits version bump to `package.json` and `CHANGELOG.md`
  - Creates git tag for the release
- **Docker Registry Auth**: Uses `DOCKER_LOGIN` and `DOCKER_PASSWORD` secrets
  - Falls back gracefully if secrets are not configured
- **Tag Handling**: Checks if tag exists before creating (prevents failures)

### PR Workflow (pr.yml) - NEW
- Runs unit tests on every PR
- Analyzes commits to suggest bump type
- Comments the suggested bump type on the PR

### Documentation
- Added `WORKFLOW_ARCHITECTURE.md` explaining the workflow design

## Workflow Architecture

**Two-step process:**
1. **PR Workflow** (on PR): Analyzes commits and suggests bump type
2. **Release Workflow** (on merge): Bumps version, creates tag, builds Docker image

## Benefits

1. **No CI Loops**: Version bump commits are detected and skipped
2. **Clear Communication**: PR comments inform developers of version impact
3. **Semantic Versioning**: Automated adherence to semver rules
4. **Traceability**: Git tags and changelog reflect all changes

## Testing

The new workflows will be tested when this PR is merged.

Closes #13 (Add database test safety configuration)

Reviewed-on: #17
Co-authored-by: David Gwilliam <dhgwilliam@gmail.com>
Co-committed-by: David Gwilliam <dhgwilliam@gmail.com>

.gitea/workflows/test.yml

@@ -4,52 +4,26 @@ on:
   push:
     branches:
       - '**'
-      - '!main'  # Skip main branch (release workflow handles that)
-  pull_request:
-    branches:
-      - main
 
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
+    container:
+      image: node:20-alpine
+      options: --user root
+    # Skip if this is an auto-generated version bump commit (handled by release workflow)
+    if: "!contains(github.event.head_commit.message, 'chore: bump version')"
 
     steps:
+      - name: Install system dependencies
+        run: |
+          apk add --no-cache bash git
+
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
       - name: Install dependencies
         run: npm ci
 
       - name: Run unit tests
         run: npm run test:run
-
-  # Acceptance tests that don't require DB read/write
-  # Only run on pull requests to main
-  safe-acceptance-tests:
-    runs-on: ubuntu-latest
-    needs: unit-tests
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run safe acceptance tests
-        # These tests should not read/write to the database
-        # They might test UI components, routing, or static content
-        run: npm run test:acceptance -- --grep "safe|static|ui|component"