fix(ci): gate Docker builds on all quality checks and fix prod image names

Build step now depends on lint, typecheck, test, and security-audit so
Docker images cannot be pushed when quality gates fail. Also corrects
docker-compose.prod.yml image names to match pipeline (stack-api, stack-web,
stack-postgres) and replaces hardcoded :latest with ${IMAGE_TAG:-latest}.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker.yml

@@ -100,9 +100,10 @@ steps:
       - *use_deps
       - pnpm build
     depends_on:
-      - typecheck # Only block on critical checks
+      - lint
+      - typecheck
+      - test
       - security-audit
-      - prisma-generate
 
   # ======================
   # Docker Build & Push (main/develop only)

docker-compose.prod.yml

@@ -16,7 +16,7 @@ services:
   # PostgreSQL Database
   # ======================
   postgres:
-    image: git.mosaicstack.dev/mosaic/postgres:latest
+    image: git.mosaicstack.dev/mosaic/stack-postgres:${IMAGE_TAG:-latest}
     container_name: mosaic-postgres
     restart: unless-stopped
     environment:
@@ -70,7 +70,7 @@ services:
   # Mosaic API
   # ======================
   api:
-    image: git.mosaicstack.dev/mosaic/api:latest
+    image: git.mosaicstack.dev/mosaic/stack-api:${IMAGE_TAG:-latest}
     container_name: mosaic-api
     restart: unless-stopped
     environment:
@@ -121,7 +121,7 @@ services:
   # Mosaic Web
   # ======================
   web:
-    image: git.mosaicstack.dev/mosaic/web:latest
+    image: git.mosaicstack.dev/mosaic/stack-web:${IMAGE_TAG:-latest}
     container_name: mosaic-web
     restart: unless-stopped
     environment: