docs: Dockerfile + nginx + CI publish для deploy на ordinis.k8s.264.nstart.cloud/docs/

Multi-stage Dockerfile: yfm build (Node 20 alpine) → nginx 1.27 alpine
serving static HTML. Nginx config:
- /healthz endpoint для k8s probes
- /docs/ alias → /usr/share/nginx/html/ (Diplodoc делает relative links,
  alias корректно работает без URL rewriting)
- Hash-named assets (_bundle/) — cache 1y immutable
- HTML pages — cache 5min must-revalidate
- /docs (без trailing slash) → 301 → /docs/
- Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)

CI:
- build-docs (sanity check) — теперь только на non-main branches и MR
  (для preview без push). Production build идёт через docker-docs.
- docker-docs (NEW) — multi-stage Dockerfile build + push в repo.nstart.cloud
  через standard .docker_base + .publish_script pattern. Path-filtered на
  docs/**, manual через web UI.
- resolve-tag: emit RESOLVED_DOCS_TAG (= IMAGE_TAG, тот же что для backend).
- trigger-deploy-{staging,prod}: pass DOCS_IMAGE_TAG в downstream pipeline.

Local verify:
  cd docs && docker build -t ordinis-docs:test .
  docker run --rm -p 18088:8080 ordinis-docs:test
  curl localhost:18088/healthz       → 200
  curl -I localhost:18088/docs       → 301 → /docs/
  curl localhost:18088/docs/         → 200 index.html
  curl localhost:18088/docs/integration/api/auth.html → 200
  curl localhost:18088/docs/missing.html → 404

Соответствующие infra-side изменения (Helm chart docs deployment + Ingress
path /docs/, values, deploy script) — commit в ordinis-infra repo.

docs/nginx.conf

@@ -0,0 +1,46 @@
+# Ordinis Integrator Guide — nginx serving static HTML на /docs/.
+# Diplodoc генерирует relative links — alias корректно работает без rewrite.
+
+server {
+  listen 8080 default_server;
+  listen [::]:8080 default_server;
+  server_name _;
+
+  access_log /dev/stdout;
+  error_log /dev/stderr;
+
+  # K8s probe.
+  location = /healthz {
+    access_log off;
+    return 200 "ok\n";
+    add_header Content-Type text/plain;
+  }
+
+  # Documentation root.
+  location /docs/ {
+    alias /usr/share/nginx/html/;
+    index index.html;
+    try_files $uri $uri/ $uri.html =404;
+
+    # HTML — short cache (5 min). Новые deploy'ы быстро видны.
+    expires 5m;
+    add_header Cache-Control "public, must-revalidate";
+
+    # Hash-named assets — long cache. Diplodoc делает content-hashing
+    # в _bundle/ что safe для immutable cache.
+    location ~* /_bundle/.*\.(css|js|woff2?|ttf|eot|svg|png|jpg|ico)$ {
+      expires 1y;
+      add_header Cache-Control "public, immutable";
+    }
+  }
+
+  # Redirect /docs (без trailing slash) → /docs/.
+  location = /docs {
+    return 301 /docs/;
+  }
+
+  # Security headers.
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "SAMEORIGIN" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+}