feat(ci): GitLab CI pipeline для build + push images

stages:
- test: mvn verify (unit + integration tests когда появятся)
- build: mvn package для всех 4 jar'ов с кэшированием Maven repo
- publish: docker build + push 4 images в registry.k8s.265.nstart.local
  с тегами {short-sha, branch-slug}. Параллельно через 4 jobs.
- trigger-deploy: запускает downstream pipeline в terravault/ordinis-infra
  с UPSTREAM_IMAGE_TAG, branch=main → dev (auto), tag=v*-rc → staging (auto),
  tag=v* (final) → prod (manual approve)

Required GitLab CI variables:
  REGISTRY_USER, REGISTRY_PASSWORD — для docker login в private registry

.gitlab-ci.yml

@@ -0,0 +1,124 @@
+# Ordinis — build & push images.
+# Helm deploy живёт в terravault/ordinis-infra (downstream pipeline).
+
+stages:
+  - test
+  - build
+  - publish
+  - trigger-deploy
+
+variables:
+  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
+  MAVEN_CLI_OPTS: "-B -ntp --batch-mode"
+  IMAGE_TAG: $CI_COMMIT_SHORT_SHA
+  REGISTRY: registry.k8s.265.nstart.local
+  IMAGE_REPO: terravault
+
+cache:
+  key:
+    files: ["pom.xml"]
+  paths:
+    - .m2/repository
+
+# ---- TEST stage ----
+maven-test:
+  stage: test
+  image: maven:3.9.9-eclipse-temurin-21
+  script:
+    - mvn $MAVEN_CLI_OPTS verify
+  artifacts:
+    when: always
+    reports:
+      junit: '**/target/surefire-reports/TEST-*.xml'
+    expire_in: 1 week
+
+# ---- BUILD stage (один общий mvn package для всех 4 jar'ов) ----
+maven-package:
+  stage: build
+  image: maven:3.9.9-eclipse-temurin-21
+  script:
+    - mvn $MAVEN_CLI_OPTS package -DskipTests
+  artifacts:
+    paths:
+      - ordinis-app/target/*.jar
+      - ordinis-read-api/target/*.jar
+      - ordinis-projection-writer/target/*.jar
+      - ordinis-migrations/target/*.jar
+      - ordinis-migrations/src/main/resources/db/changelog/**
+    expire_in: 1 day
+
+# ---- PUBLISH stage (4 image параллельно) ----
+.docker-image-template: &docker-image
+  stage: publish
+  image: docker:27
+  services: [docker:27-dind]
+  variables:
+    DOCKER_TLS_CERTDIR: "/certs"
+  before_script:
+    - echo "$REGISTRY_PASSWORD" | docker login $REGISTRY -u "$REGISTRY_USER" --password-stdin
+
+docker-app:
+  <<: *docker-image
+  script:
+    - docker build -f ordinis-app/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-app:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-app:$CI_COMMIT_REF_SLUG .
+    - docker push $REGISTRY/$IMAGE_REPO/ordinis-app --all-tags
+  needs: [maven-package]
+
+docker-read-api:
+  <<: *docker-image
+  script:
+    - docker build -f ordinis-read-api/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-read-api:$CI_COMMIT_REF_SLUG .
+    - docker push $REGISTRY/$IMAGE_REPO/ordinis-read-api --all-tags
+  needs: [maven-package]
+
+docker-projection-writer:
+  <<: *docker-image
+  script:
+    - docker build -f ordinis-projection-writer/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-projection-writer:$CI_COMMIT_REF_SLUG .
+    - docker push $REGISTRY/$IMAGE_REPO/ordinis-projection-writer --all-tags
+  needs: [maven-package]
+
+docker-migrations:
+  <<: *docker-image
+  script:
+    - docker build -f ordinis-migrations/Dockerfile -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$IMAGE_TAG -t $REGISTRY/$IMAGE_REPO/ordinis-migrations:$CI_COMMIT_REF_SLUG ordinis-migrations/
+    - docker push $REGISTRY/$IMAGE_REPO/ordinis-migrations --all-tags
+  needs: [maven-package]
+
+# ---- TRIGGER DEPLOY: запускает downstream pipeline в ordinis-infra ----
+trigger-deploy-dev:
+  stage: trigger-deploy
+  trigger:
+    project: 2-6/2-6-4/terravault/ordinis-infra
+    branch: main
+    strategy: depend
+  variables:
+    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
+    DEPLOY_ENV: dev
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+
+trigger-deploy-staging:
+  stage: trigger-deploy
+  trigger:
+    project: 2-6/2-6-4/terravault/ordinis-infra
+    branch: main
+    strategy: depend
+  variables:
+    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
+    DEPLOY_ENV: staging
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+-rc.*/'
+
+trigger-deploy-prod:
+  stage: trigger-deploy
+  trigger:
+    project: 2-6/2-6-4/terravault/ordinis-infra
+    branch: main
+    strategy: depend
+  variables:
+    UPSTREAM_IMAGE_TAG: $IMAGE_TAG
+    DEPLOY_ENV: prod
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
+      when: manual