feat(CUB-65): add multi-stage Dockerfile and .dockerignore for backend

Reviewed-on: #9
Reviewed-by: Joshua <joshua@cnjmail.com>

.gitea/workflows/dev.yml

@@ -0,0 +1,77 @@
+name: Dev Build
+
+on:
+  pull_request:
+    branches: [dev]
+  push:
+    branches: [dev]
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Restore backend
+        run: dotnet restore
+
+      - name: Build backend
+        run: dotnet build --no-restore --configuration Release
+
+      - name: Test backend
+        run: dotnet test --no-build --configuration Release
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Install frontend deps
+        run: npm ci
+        working-directory: ./frontend
+
+      - name: Build frontend
+        run: npm run build
+        working-directory: ./frontend
+
+  deploy-dev:
+    needs: build-test
+    if: gitea.event_name == 'push'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Deploy dev
+        run: |
+          echo "${{ secrets.DEV_DEPLOY_SSH_KEY }}" > /tmp/dev_key
+          chmod 600 /tmp/dev_key
+          ssh -i /tmp/dev_key -o StrictHostKeyChecking=no \
+            ${{ secrets.DEV_DEPLOY_USER }}@${{ secrets.DEV_DEPLOY_HOST }} \
+            "${{ secrets.DEV_DEPLOY_PATH }}/deploy.sh"
+
+  notify-success:
+    needs: [build-test, deploy-dev]
+    if: success() && gitea.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Slack success
+        run: |
+          curl -X POST -H 'Content-type: application/json' \
+            --data "{\"text\":\"✅ Extrudex dev deployed successfully from dev branch.\"}" \
+            "${{ secrets.SLACK_WEBHOOK_URL }}"
+
+  notify-failure:
+    needs: [build-test, deploy-dev]
+    if: failure()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify Slack failure
+        run: |
+          curl -X POST -H 'Content-type: application/json' \
+            --data "{\"text\":\"🚨 Extrudex dev pipeline failed. Check Gitea Actions for details.\"}" \
+            "${{ secrets.SLACK_WEBHOOK_URL }}"

backend/.dockerignore

@@ -0,0 +1,27 @@
+# Build artifacts
+bin/
+obj/
+
+# IDE / editor
+.vs/
+.vscode/
+*.user
+*.suo
+.idea/
+
+# Environment & secrets
+appsettings.Development.json
+.env
+.env.*
+
+# Docker
+Dockerfile
+.dockerignore
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Misc
+*.md
+*.log

backend/Dockerfile

@@ -0,0 +1,30 @@
+# ── Stage 1: Build ──────────────────────────────────────────
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
+WORKDIR /src
+
+# Copy csproj first for layer caching — restores before copying source
+COPY Extrudex.csproj .
+RUN dotnet restore
+
+# Copy the rest of the source
+COPY . .
+RUN dotnet publish Extrudex.csproj \
+    -c Release \
+    -o /app/publish \
+    --no-restore
+
+# ── Stage 2: Runtime ────────────────────────────────────────
+FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS runtime
+WORKDIR /app
+
+# Non-root user for security
+RUN adduser --disabled-password --gecos "" appuser
+USER appuser
+
+# Copy published output from build stage
+COPY --from=build /app/publish .
+
+# ASP.NET Core listens on 8080 by default in .NET 8+
+EXPOSE 8080
+
+ENTRYPOINT ["dotnet", "Extrudex.dll"]