ci: add deploy stage to trigger Coolify after CI passes

Deploy job runs only on main branch after all quality checks and tests
succeed, replacing the immediate push webhook with a gated deployment.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -95,3 +95,20 @@ jobs:
       - name: Run tests (web)
         run: cargo test --features web --no-default-features
 
+  # ---------------------------------------------------------------------------
+  # Stage 3: Deploy (only after tests pass, only on main)
+  # ---------------------------------------------------------------------------
+  deploy:
+    name: Deploy
+    runs-on: docker
+    needs: [test]
+    if: github.ref == 'refs/heads/main'
+    container:
+      image: alpine:latest
+    steps:
+      - name: Trigger Coolify deploy
+        run: |
+          apk add --no-cache curl
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK }}" \
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
+