ci(forgejo): guard deploy-stage — main code ≠ stage DB schema

The stage DB is on Phase2c3_MsStrict (vat_rates dropped, etc.), but
main still has Product.VatRateId / DbSet<VatRate> and friends — that
code would blow up at startup against the current DB. The user's
'feat strict MoySklad schema' commit (f7087e9) isn't present in main
any more (looks like a rebase dropped it); the pre-built image with
that SHA is still in the registry and that's what the stage is pinned
to right now.

Until main gets the matching code, deploy-stage should only fire on
tag or manual dispatch — push-to-main still builds images, just
doesn't roll the stage forward.

.forgejo/workflows/docker.yml

@@ -56,6 +56,13 @@ jobs:
     name: Deploy stage
     runs-on: [self-hosted, linux]
     needs: [api, web]
+    # Temporary guard: main currently contains references to VatRate etc. while
+    # the stage DB is already on Phase2c3_MsStrict (vat_rates dropped). Until
+    # the user lands the matching code changes on main, an auto-deploy of a
+    # freshly built image from main would break the API. Run deploy only on
+    # tag/dispatch; normal pushes still build + push images to the local
+    # registry, but don't roll the stage forward.
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@v4