Apply docker specialist review: pin image, fresh bases, longer wait

- Pin deploy container to docker:27-cli (avoid compose version drift)
- Add --pull to both docker build commands (keep base images fresh)
- Increase health check sleep to 30s (backend start_period is 30s)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -20,7 +20,8 @@ jobs:
 
       - name: Build and push backend
         run: |
-          docker build -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest \
+          docker build --pull \
+                       -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest \
                        -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:${{ github.sha }} \
                        ./backend
           docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-backend:main-latest
@@ -28,7 +29,8 @@ jobs:
 
       - name: Build and push frontend
         run: |
-          docker build -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest \
+          docker build --pull \
+                       -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest \
                        -t ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:${{ github.sha }} \
                        ./frontend
           docker push ${{ vars.REGISTRY_HOST }}/rohskiddo/umbra-frontend:main-latest
@@ -45,7 +47,7 @@ jobs:
             -v /var/run/docker.sock:/var/run/docker.sock \
             -v ${{ vars.DEPLOY_PATH }}:/deploy \
             -w /deploy \
-            docker:cli sh -c "
+            docker:27-cli sh -c "
               docker compose pull backend frontend &&
               docker compose up -d --remove-orphans
             "
@@ -53,7 +55,7 @@ jobs:
       - name: Health check
         run: |
           echo "Waiting for services to start..."
-          sleep 15
+          sleep 30
           curl -f http://localhost/health || exit 1
 
       - name: Prune old images