fix(ci): gate Docker builds on all quality checks and fix prod image names

Build step now depends on lint, typecheck, test, and security-audit so
Docker images cannot be pushed when quality gates fail. Also corrects
docker-compose.prod.yml image names to match pipeline (stack-api, stack-web,
stack-postgres) and replaces hardcoded :latest with ${IMAGE_TAG:-latest}.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker.yml

@@ -100,9 +100,10 @@ steps:
       - *use_deps
       - pnpm build
     depends_on:
-      - typecheck # Only block on critical checks
+      - lint
+      - typecheck
+      - test
       - security-audit
-      - prisma-generate
 
   # ======================
   # Docker Build & Push (main/develop only)