fix(dev): switch Keycloak to dev-file + persistent volume

KC_DB was set to dev-mem (H2 in-memory) — every time the keycloak
container went idle or restarted, the realm + the M7.1 test users
dissolved and the next smoke run failed with token_not_found until
realm-export was re-imported manually. Bit twice during the M7.1
testing session.

dev-file points H2 at /opt/keycloak/data/h2/ and the new
keycloak-data named volume keeps it across container lifecycles. The
realm-export.json bind-mount is still read-only and re-imported on
fresh starts via `--import-realm`, so a `docker compose down -v` is
still the canonical "rebuild from scratch" lever.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -9,13 +9,6 @@ on:
       - main
 
 env:
-  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
-  # username contains '$', which sh expands when interpolated into the
-  # script (robot$ci-push -> robot-push) => docker login unauthorized.
-  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
-  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   # sccache caches compilation artifacts within a job so that compiling
@@ -280,14 +273,11 @@ jobs:
           git checkout FETCH_HEAD
       - name: Build and push image
         run: |
-          IMAGE=repo.breakpilot.com/certifai/certifai-dashboard
-          echo "$REGISTRY_PASSWORD" | \
-            docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          IMAGE=registry.meghsakha.com/certifai-dashboard
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
+            docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           docker build -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest"
-          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
-          chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           docker push "$IMAGE:${GITHUB_SHA}"
       - name: Trigger orca redeploy
         run: |