ci(deploy): migrate build to docker:28.4.0-dind + GitLab container registry

deploy/k8s/README.md

@@ -59,10 +59,9 @@ is CI's job to decide — it's an explicit, human-triggered event.
 | 7 | Ingress `vncmail-plus` | `base/ingress.yaml` (+ overlay patches for prod) | TLS host |
 
 **Image:** CI builds and pushes to `registry.gitlab.vnc.biz/gitlab-instance-b9b5cf2f/vncmail-plus`
-(tag `sha-<sha>` per deploy, moving pointers `dev-latest`/`prod-latest`). The
-`ghcr.io/brvncde-dotcom/vncmail-plus-dev` image referenced in `base/deployment.yaml`
-is a legacy default only — CI overrides it per-deploy via `kubectl set image`,
-so what's committed there never needs to track what's actually running.
+(tag `sha-<sha>` per deploy, moving pointer `dev-latest`). The generic `vncmail-plus`
+image name in `base/deployment.yaml` is a placeholder — kustomize's image-tag
+Component replaces it with the real registry path on every deploy.
 
 ---
 
@@ -98,15 +97,15 @@ pick up the fix):
 ```bash
 cd deploy/k8s/overlays/dev     # or overlays/prod, once real
 
-# a) Image-pull secret — the registry package is private.
-kubectl create secret docker-registry ghcr-pull \
+# a) Image-pull secret — the GitLab registry requires authentication.
+#    Use a project deploy token with `read_registry` scope, or the CI job
+#    token (short-lived — better for CI, not for long-running clusters).
+kubectl create secret docker-registry gitlab-registry \
   --namespace vncmail \
-  --docker-server=ghcr.io \
-  --docker-username=brvncde-dotcom \
-  --docker-password='<GITHUB_PAT_read:packages>' \
-  --docker-email=br@vnc.biz
-#    Once CI has cut over to registry.gitlab.vnc.biz, this becomes a
-#    docker-registry secret for that registry instead — see VNCMAIL-SETUP.md.
+  --docker-server=registry.gitlab.vnc.biz \
+  --docker-username=<deploy-token-name> \
+  --docker-password='<deploy-token-secret>' \
+  --docker-email=ci@vnc.biz
 
 # b) App config secret — copy the template, set a real SESSION_SECRET, apply.
 cp secret.example.yaml secret.yaml
@@ -117,8 +116,8 @@ kubectl apply -f secret.yaml
 kubectl apply -k .
 ```
 
-> Alternative to (a): make the registry package public, then delete the
-> `imagePullSecrets:` block from `base/deployment.yaml`.
+> Alternative to (a): make the GitLab container registry public for this
+> project, then delete the `imagePullSecrets:` block from `base/deployment.yaml`.
 
 After this one-time setup, routine deploys to `dev` happen automatically via
 CI on every push — see "Routine deploys go through CI now" above. This
@@ -170,7 +169,7 @@ ArgoCD re-sync.
 
 | Symptom | Cause / fix |
 |---------|-------------|
-| Pod `ImagePullBackOff` | `ghcr-pull` secret missing/expired, or package still private. Recreate the secret (§3a) or make the package public. |
+| Pod `ImagePullBackOff` | `gitlab-registry` secret missing/expired, or token lacks `read_registry`. Recreate the secret (§3a) or make the registry public. |
 | Pod `CrashLoopBackOff`, logs show `EACCES`/permission on `/app/data` | Volume not writable by uid 1001. `securityContext.fsGroup: 1001` is set in `base/deployment.yaml` — keep it; some storage drivers also need it on the PVC. |
 | PVC stuck `Pending` | Wrong `storageClassName` in `base/pvc.yaml`. Set it to one from `kubectl get sc`. |
 | Ingress has no address / no cert | Wrong `ingressClassName` or cert issuer. Match bulwark's (§2). Check `kubectl -n vncmail describe ingress vncmail-plus`. |