feat(deploy): Phase 6 — публичный сайт на food-market.zat.kz, админка на app.

Доменная схема (по решению юзера):
  food-market.zat.kz → новый Astro public-сайт (порт 8082, контейнер food-market-public)
  app.food-market.zat.kz → существующая админка (food-market.web, порт 8081)
  API остаётся на app.* под /api/*.

Изменения:
- docker-compose: добавлен сервис public (image food-market-public:latest,
  127.0.0.1:8082:80). На стенде .env дополнен PUBLIC_TAG=latest, контейнер
  поднят, smoke на / и /pricing проходит.
- Forgejo workflow .forgejo/workflows/docker-public.yml — отдельный билд
  при изменениях в src/food-market.public/**: docker build с
  --build-arg PUBLIC_SITE_URL=https://food-market.zat.kz и
  --build-arg PUBLIC_APP_URL=https://app.food-market.zat.kz, push в
  локальный registry, deploy через docker compose pull+up. TG-пинг.
- Nginx (на стенде вручную, не через репо):
  - Новый блок food-market-app.conf для app.food-market.zat.kz —
    проксирует на :8081 (web), вместе с /api/admin/import/ и
    /tg-webhook путями. Certbot --nginx выпустил SSL.
  - Старый food-market-stage.conf переписан на public — проксирует на
    :8082, использует существующий SSL для food-market.zat.kz.
- API CORS: добавлены food-market.zat.kz, app.food-market.zat.kz,
  food-market.kz, app.food-market.kz в AllowedOrigins (publicу нужен
  food-market.zat.kz для signup-запросов, админке нужен app.*).
- JWT cookie domain не настраиваем — проект использует localStorage,
  cross-domain auth-bridge через URL fragment (см. AuthBridgePage),
  что безопаснее cookie с .food-market.zat.kz.
- Хардкодов food-market.zat.kz в food-market.web/src не нашлось —
  всё через относительные URL.

Существующие админ-сессии: токены в localStorage привязаны к
food-market.zat.kz origin. После переезда юзеры увидят на этом
домене публичный сайт без своих токенов — нужно перелогиниться
на app.food-market.zat.kz.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/docker-public.yml

@@ -0,0 +1,99 @@
+name: Docker Public
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/food-market.public/**'
+      - 'deploy/docker-compose.yml'
+      - '.forgejo/workflows/docker-public.yml'
+  workflow_dispatch:
+
+env:
+  LOCAL_REGISTRY: 127.0.0.1:5001
+  PUBLIC_SITE_URL: https://food-market.zat.kz
+  PUBLIC_APP_URL: https://app.food-market.zat.kz
+
+jobs:
+  build:
+    name: Build + push Public
+    runs-on: [self-hosted, linux]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build + push
+        env:
+          SHA: ${{ github.sha }}
+          DOCKER_BUILDKIT: '1'
+        run: |
+          docker build \
+            --build-arg PUBLIC_SITE_URL=$PUBLIC_SITE_URL \
+            --build-arg PUBLIC_APP_URL=$PUBLIC_APP_URL \
+            -f src/food-market.public/Dockerfile \
+            -t $LOCAL_REGISTRY/food-market-public:$SHA \
+            -t $LOCAL_REGISTRY/food-market-public:latest \
+            src/food-market.public
+          docker push $LOCAL_REGISTRY/food-market-public:$SHA
+          docker push $LOCAL_REGISTRY/food-market-public:latest
+
+  deploy:
+    name: Deploy Public on stage
+    needs: build
+    runs-on: [self-hosted, linux]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update compose + .env
+        env:
+          PGPASS: ${{ secrets.STAGE_POSTGRES_PASSWORD }}
+        run: |
+          cat > /home/nns/food-market-stage/deploy/.env <<ENV
+          REGISTRY=127.0.0.1:5001
+          API_TAG=latest
+          WEB_TAG=latest
+          PUBLIC_TAG=latest
+          POSTGRES_PASSWORD=$PGPASS
+          ENV
+          cp deploy/docker-compose.yml /home/nns/food-market-stage/deploy/docker-compose.yml
+
+      - name: Pull + recreate public only
+        working-directory: /home/nns/food-market-stage/deploy
+        run: |
+          docker compose pull public
+          docker compose up -d --no-deps public
+
+      - name: Smoke
+        run: |
+          for i in 1 2 3 4 5 6; do
+            sleep 4
+            if curl -fsS http://127.0.0.1:8082/ -o /dev/null; then
+              echo "Public OK"
+              exit 0
+            fi
+          done
+          echo "Public smoke failed"
+          exit 1
+
+      - name: Notify Telegram on success
+        if: success()
+        env:
+          BOT: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT: ${{ secrets.TELEGRAM_CHAT_ID }}
+          SHA: ${{ github.sha }}
+        run: |
+          curl -sS -X POST "https://api.telegram.org/bot$BOT/sendMessage" \
+            --data-urlencode "chat_id=$CHAT" \
+            --data-urlencode "text=✅ stage public deployed — ${SHA:0:7} → https://food-market.zat.kz" \
+            > /dev/null
+
+      - name: Notify Telegram on failure
+        if: failure()
+        env:
+          BOT: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT: ${{ secrets.TELEGRAM_CHAT_ID }}
+          SHA: ${{ github.sha }}
+        run: |
+          curl -sS -X POST "https://api.telegram.org/bot$BOT/sendMessage" \
+            --data-urlencode "chat_id=$CHAT" \
+            --data-urlencode "text=❌ stage public deploy FAILED — ${SHA:0:7}" \
+            > /dev/null

deploy/docker-compose.yml

@@ -48,6 +48,13 @@ services:
     ports:
       - "8081:80"  # web SPA, not on 80 (legacy nginx holds it)
 
+  public:
+    image: ${REGISTRY:-127.0.0.1:5001}/food-market-public:${PUBLIC_TAG:-latest}
+    container_name: food-market-public
+    restart: unless-stopped
+    ports:
+      - "8082:80"  # marketing astro static
+
 volumes:
   postgres-data:
     name: food-market-postgres-data

src/food-market.api/appsettings.json

@@ -30,7 +30,11 @@
   "Cors": {
     "AllowedOrigins": [
       "http://localhost:5173",
-      "http://localhost:4173"
+      "http://localhost:4173",
+      "https://food-market.zat.kz",
+      "https://app.food-market.zat.kz",
+      "https://food-market.kz",
+      "https://app.food-market.kz"
     ]
   },
   "AllowedHosts": "*"