fix(ci): Use docker:dind with manual login instead of buildx plugin

The buildx plugin's credential handling doesn't work properly with
Harbor. The docker-auth-test step proved that standard docker login
works, so we switch to:
- docker:dind image
- Manual docker login before build
- Standard docker build and docker push

This bypasses buildx's separate credential store issue.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.woodpecker.yml

@@ -84,91 +84,59 @@ steps:
   # ======================
   # Requires secrets: harbor_username, harbor_password
 
-  # Debug step - test registry auth before building
+  # Build and push API image
-  docker-auth-test:
+  docker-build-api:
-    image: docker:cli
+    image: docker:dind
     environment:
       HARBOR_USER:
         from_secret: harbor_username
       HARBOR_PASS:
         from_secret: harbor_password
     commands:
-      - echo "Testing Harbor authentication..."
-      - echo "Username length:" $(echo -n "$HARBOR_USER" | wc -c)
-      - echo "Password length:" $(echo -n "$HARBOR_PASS" | wc -c)
       - echo "$HARBOR_PASS" | docker login reg.mosaicstack.dev -u "$HARBOR_USER" --password-stdin
-      - echo "Login successful!"
+      - docker build -t reg.mosaicstack.dev/mosaic/api:${CI_COMMIT_SHA:0:8} -t reg.mosaicstack.dev/mosaic/api:latest -f apps/api/Dockerfile .
-      - docker logout reg.mosaicstack.dev
+      - docker push reg.mosaicstack.dev/mosaic/api:${CI_COMMIT_SHA:0:8}
+      - docker push reg.mosaicstack.dev/mosaic/api:latest
     when:
       - branch: [main, develop]
         event: [push, manual]
     depends_on:
       - build
 
-  docker-build-api:
+  # Build and push Web image
-    image: woodpeckerci/plugin-docker-buildx
-    settings:
-      registry: reg.mosaicstack.dev
-      repo: mosaic/api
-      dockerfile: apps/api/Dockerfile
-      context: .
-      platforms:
-        - linux/amd64
-      tags:
-        - "${CI_COMMIT_SHA:0:8}"
-        - latest
-      username:
-        from_secret: harbor_username
-      password:
-        from_secret: harbor_password
-    when:
-      - branch: [main, develop]
-        event: [push, manual]
-    depends_on:
-      - docker-auth-test
-
   docker-build-web:
-    image: woodpeckerci/plugin-docker-buildx
+    image: docker:dind
-    settings:
+    environment:
-      registry: reg.mosaicstack.dev
+      HARBOR_USER:
-      repo: mosaic/web
-      dockerfile: apps/web/Dockerfile
-      context: .
-      platforms:
-        - linux/amd64
-      build_args:
-        - NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev
-      tags:
-        - "${CI_COMMIT_SHA:0:8}"
-        - latest
-      username:
         from_secret: harbor_username
-      password:
+      HARBOR_PASS:
         from_secret: harbor_password
+    commands:
+      - echo "$HARBOR_PASS" | docker login reg.mosaicstack.dev -u "$HARBOR_USER" --password-stdin
+      - docker build --build-arg NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev -t reg.mosaicstack.dev/mosaic/web:${CI_COMMIT_SHA:0:8} -t reg.mosaicstack.dev/mosaic/web:latest -f apps/web/Dockerfile .
+      - docker push reg.mosaicstack.dev/mosaic/web:${CI_COMMIT_SHA:0:8}
+      - docker push reg.mosaicstack.dev/mosaic/web:latest
     when:
       - branch: [main, develop]
         event: [push, manual]
     depends_on:
-      - docker-auth-test
+      - build
 
+  # Build and push Postgres image
   docker-build-postgres:
-    image: woodpeckerci/plugin-docker-buildx
+    image: docker:dind
-    settings:
+    environment:
-      registry: reg.mosaicstack.dev
+      HARBOR_USER:
-      repo: mosaic/postgres
-      dockerfile: docker/postgres/Dockerfile
-      context: docker/postgres
-      platforms:
-        - linux/amd64
-      tags:
-        - "${CI_COMMIT_SHA:0:8}"
-        - latest
-      username:
         from_secret: harbor_username
-      password:
+      HARBOR_PASS:
         from_secret: harbor_password
+    commands:
+      - echo "$HARBOR_PASS" | docker login reg.mosaicstack.dev -u "$HARBOR_USER" --password-stdin
+      - docker build -t reg.mosaicstack.dev/mosaic/postgres:${CI_COMMIT_SHA:0:8} -t reg.mosaicstack.dev/mosaic/postgres:latest -f docker/postgres/Dockerfile docker/postgres
+      - docker push reg.mosaicstack.dev/mosaic/postgres:${CI_COMMIT_SHA:0:8}
+      - docker push reg.mosaicstack.dev/mosaic/postgres:latest
     when:
       - branch: [main, develop]
         event: [push, manual]
     depends_on:
-      - docker-auth-test
+      - build