refactor: update Docker build context and paths in CI configuration and documentation

Modified the CI workflow to include the `--allow=fs.read` flag for Docker build commands, allowing access to the repository context. Updated the `docker-bake.hcl` file to reflect the correct paths for Dockerfiles, ensuring consistency with the new structure. Adjusted the README to clarify the changes in build commands and paths, enhancing overall documentation accuracy.

.gitea/workflows/ci.yaml

@@ -225,13 +225,13 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: ""
-          # buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl go-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: Web (evobgp-web, evobgp-web-all) — один npm ci (кэш) + два nginx-тега.
@@ -274,7 +274,8 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl web-images --push
 
   # ---------------------------------------------------------------------------
   # Docker: BIRD2 (evobgp-bird2).
@@ -318,4 +319,5 @@ jobs:
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
           sh write-bake-override.sh
-          docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" \
+            -f docker-bake.hcl -f docker-bake.override.hcl evobgp-bird2 --push