Split Drone CI and tag-triggered deployment

[yaojin3616]

What changed

• Keep docker-compose.ci.yml dedicated to isolated migration, fresh deployment, and upgrade tests.
• Add docker-compose.cd.yml for application-only deployment against the server's existing PostgreSQL, Redis, MinIO, and external Docker network.
• Run image export, SCP, and remote restart only for tag events.
• Limit production deployment to formal v* tags.
• Deploy through qinrui on port 10022 into /home/qinrui/clawith_new.
• Load the transferred backend/frontend images, recreate backend-api, backend-worker, and frontend, and wait for the proxied API health check.
• Preserve server-owned .env and Nginx configuration. If the optional ss-nodes.json bind source is absent—or exists as Docker's accidental empty directory—repair it to a safe empty [] configuration without overwriting a real file.
• Have the Release GitHub Actions workflow push the immutable release tag and publish the GitHub Release immediately, while Drone handles deployment asynchronously.
• Remove the parallel GitHub Actions SSH deployment path and its obsolete deployment script.

Why

The previous pipeline mixed CI test Compose configuration with production deployment concerns, transferred images on branch pushes, and did not restart the remote services. Separating the Compose files keeps CI isolated while making CD explicitly tag-triggered and aligned with the current server layout.

The Release workflow also deployed directly over SSH after pushing its tag. Once Drone became tag-triggered, both systems would recreate production concurrently. GitHub Actions now hands the tag to Drone as the single deployment owner and exits without consuming runner time while the deployment runs.

Validation

• drone lint --trusted .github/drone.yml
• Docker Compose v5.3.1 config --quiet for both CI and CD configurations
• Shell syntax checks for all CI scripts and the generated remote SSH script
• Actionlint v1.7.12 for the Release workflow
• Local bare-repository tests for release tag creation, idempotent reuse, and mismatch rejection
• Real tag-triggered Drone CI/CD smoke test: build [Bug] Multi-tenant Logout State Not Properly Cleared #405 passed all nine steps
  • image build
  • fresh database migration
  • fresh deployment
  • upgrade from v1.11.2 with persistence checks
  • image export and SCP
  • remote image load and service recreation
  • health check and cleanup

Drone build: http://110.16.193.170:50059/dataelement/Clawith/405