docker: image for the Oracle server, Trivy gate, and a release workflow

Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
   push:
     branches: [main]
+  # O release.yml roda esta mesma suíte antes de publicar a imagem.
+  workflow_call:
 
 permissions:
   contents: read
@@ -46,3 +48,46 @@ jobs:
       - run: npm run check
 
       - run: npm run build
+
+  # Trivy roda pela imagem oficial: o trivy-action clona o repositório do Trivy
+  # do mesmo servidor do workflow, que aqui é o Gitea, e não o GitHub.
+  # O workspace do job é um volume que o daemon não enxerga, então os arquivos
+  # entram no container com `docker cp` em vez de `-v`.
+  seguranca:
+    name: Trivy (dependências e segredos)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Repositório
+        run: |
+          cid=$(docker create --network host -v trivy-cache:/root/.cache/ -w /src aquasec/trivy:0.70.0 \
+            fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 .)
+          docker cp . "$cid:/src"
+          docker start -a "$cid"
+          status=$(docker inspect -f '{{.State.ExitCode}}' "$cid")
+          docker rm "$cid" >/dev/null
+          exit "$status"
+
+  imagem:
+    name: Imagem Docker
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # `docker build` simples: o cache de camadas fica no volume persistente do
+      # daemon do runner, e o buildx criaria um BuildKit novo a cada job.
+      - name: Build
+        run: docker build -t espdocs:ci .
+      - name: Trivy na imagem
+        run: |
+          docker run --rm --network host -v trivy-cache:/root/.cache/ -e DOCKER_HOST=tcp://127.0.0.1:2375 aquasec/trivy:0.70.0 \
+            image --severity HIGH,CRITICAL --exit-code 1 espdocs:ci
+      - name: A imagem sobe e responde
+        run: |
+          docker run -d --name espdocs-ci --network host -e PORT=3999 espdocs:ci
+          for i in $(seq 1 30); do
+            curl -fsS http://127.0.0.1:3999/ >/dev/null && ok=1 && break
+            sleep 2
+          done
+          docker logs espdocs-ci | tail -5
+          docker rm -f espdocs-ci >/dev/null
+          test "${ok:-0}" = 1