ci: use 'extends:' instead of YAML <<: anchor merge

GitLab CI YAML <<: doesn't deep-merge — per-job 'variables:' overwrites
the anchor's variables block, so DOCKER_HOST/DOCKER_TLS_CERTDIR were
lost and the docker client fell back to default tcp://docker:2375 (no
TLS). 'extends:' merges variables key-by-key, so per-job SVC/DOCKERFILE
add to the base instead of replacing it.

.gitlab-ci.yml

@@ -60,7 +60,7 @@ maven-package:
     expire_in: 1 day
 
 # ─── PUBLISH (Docker images) ───────────────────
-.docker_base: &docker_base
+.docker_base:
   stage: publish
   image: repo.nstart.cloud/library/docker:26
   services:
@@ -88,7 +88,7 @@ maven-package:
   docker push "$IMG:$CI_COMMIT_REF_SLUG"
 
 docker-app:
-  <<: *docker_base
+  extends: .docker_base
   needs: [maven-package]
   variables:
     SVC: ordinis-app
@@ -98,7 +98,7 @@ docker-app:
     - *publish_script
 
 docker-read-api:
-  <<: *docker_base
+  extends: .docker_base
   needs: [maven-package]
   variables:
     SVC: ordinis-read-api
@@ -108,7 +108,7 @@ docker-read-api:
     - *publish_script
 
 docker-projection-writer:
-  <<: *docker_base
+  extends: .docker_base
   needs: [maven-package]
   variables:
     SVC: ordinis-projection-writer
@@ -118,7 +118,7 @@ docker-projection-writer:
     - *publish_script
 
 docker-migrations:
-  <<: *docker_base
+  extends: .docker_base
   needs: [maven-package]
   variables:
     SVC: ordinis-migrations