feat(docker): add Docker Hub authentication for CI/CD workflows

- Introduced `docker_hub_token` and `docker_hub_username` secrets for Docker Hub login in CI/CD workflows.
- Updated `.gitea/workflows/ci.yaml`, `.gitea/workflows/cd.yaml`, and `.gitea/workflows/quality.yaml` to utilize these secrets for Docker Hub authentication.
- Enhanced README and releasing documentation to clarify the use of Docker Hub credentials for image mirroring and builds.

.gitea/README.md

@@ -39,6 +39,8 @@ Runner: `ubuntu-latest`, **bird2** из apt, Docker для **docker-check** (PR)
 
 **`ACTIONS_PAT`**: push tags, releases, Container Registry. Для git tag fallback: `github.token`. Push OCI — **только PAT** (у `GITEA_TOKEN` нет права packages).
 
+**`docker_hub_token`**: PAT Docker Hub (Settings → Actions → Secrets, можно на уровне организации). Логин перед зеркалом `docker.io` и `bake`, чтобы не ловить anonymous 429. Логин: `docker_hub_username` (если задан) или `gitea.actor`.
+
 ### Теги образов
 
 ```text

.gitea/workflows/cd.yaml

@@ -17,6 +17,8 @@ jobs:
       allow_registry_login: false
     secrets:
       ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
+      docker_hub_token: ${{ secrets.docker_hub_token }}
+      docker_hub_username: ${{ secrets.docker_hub_username }}
 
   publish:
     needs: [quality]
@@ -107,6 +109,12 @@ jobs:
           short_sha="$(echo '${{ github.sha }}' | cut -c1-7)"
           echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
           echo "build_time=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
+      - name: Log in to Docker Hub
+        if: steps.rel.outputs.released == 'true'
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.docker_hub_username || gitea.actor }}
+          password: ${{ secrets.docker_hub_token }}
       - name: Log in to Gitea Registry
         if: steps.rel.outputs.released == 'true'
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0

.gitea/workflows/ci.yaml

@@ -21,3 +21,5 @@ jobs:
       allow_registry_login: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     secrets:
       ACTIONS_PAT: ${{ secrets.ACTIONS_PAT }}
+      docker_hub_token: ${{ secrets.docker_hub_token }}
+      docker_hub_username: ${{ secrets.docker_hub_username }}

.gitea/workflows/quality.yaml

@@ -26,6 +26,10 @@ on:
     secrets:
       ACTIONS_PAT:
         required: false
+      docker_hub_token:
+        required: false
+      docker_hub_username:
+        required: false
 
 permissions:
   contents: read
@@ -397,6 +401,12 @@ jobs:
           name: evobgp
           driver: docker-container
           cleanup: false
+      - name: Log in to Docker Hub
+        if: secrets.docker_hub_token != ''
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.docker_hub_username || gitea.actor }}
+          password: ${{ secrets.docker_hub_token }}
       - name: Log in to Gitea Registry
         if: inputs.allow_registry_login
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0

apps/web/src/components/ui/svgs/claudeAiIcon.tsx

@@ -0,0 +1,12 @@
+import type { SVGProps } from "react";
+
+const ClaudeAiIcon = (props: SVGProps<SVGSVGElement>) => (
+  <svg {...props} preserveAspectRatio="xMidYMid" viewBox="0 0 256 257">
+    <path
+      fill="#D97757"
+      d="m50.228 170.321 50.357-28.257.843-2.463-.843-1.361h-2.462l-8.426-.518-28.775-.778-24.952-1.037-24.175-1.296-6.092-1.297L0 125.796l.583-3.759 5.12-3.434 7.324.648 16.202 1.101 24.304 1.685 17.629 1.037 26.118 2.722h4.148l.583-1.685-1.426-1.037-1.101-1.037-25.147-17.045-27.22-18.017-14.258-10.37-7.713-5.25-3.888-4.925-1.685-10.758 7-7.713 9.397.649 2.398.648 9.527 7.323 20.35 15.75L94.817 91.9l3.889 3.24 1.555-1.102.195-.777-1.75-2.917-14.453-26.118-15.425-26.572-6.87-11.018-1.814-6.61c-.648-2.723-1.102-4.991-1.102-7.778l7.972-10.823L71.42 0 82.05 1.426l4.472 3.888 6.61 15.101 10.694 23.786 16.591 32.34 4.861 9.592 2.592 8.879.973 2.722h1.685v-1.556l1.36-18.211 2.528-22.36 2.463-28.776.843-8.1 4.018-9.722 7.971-5.25 6.222 2.981 5.12 7.324-.713 4.73-3.046 19.768-5.962 30.98-3.889 20.739h2.268l2.593-2.593 10.499-13.934 17.628-22.036 7.778-8.749 9.073-9.657 5.833-4.601h11.018l8.1 12.055-3.628 12.443-11.342 14.388-9.398 12.184-13.48 18.147-8.426 14.518.778 1.166 2.01-.194 30.46-6.481 16.462-2.982 19.637-3.37 8.88 4.148.971 4.213-3.5 8.62-20.998 5.184-24.628 4.926-36.682 8.685-.454.324.519.648 16.526 1.555 7.065.389h17.304l32.21 2.398 8.426 5.574 5.055 6.805-.843 5.184-12.962 6.611-17.498-4.148-40.83-9.721-14-3.5h-1.944v1.167l11.666 11.406 21.387 19.314 26.767 24.887 1.36 6.157-3.434 4.86-3.63-.518-23.526-17.693-9.073-7.972-20.545-17.304h-1.36v1.814l4.73 6.935 25.017 37.59 1.296 11.536-1.814 3.76-6.481 2.268-7.13-1.297-14.647-20.544-15.1-23.138-12.185-20.739-1.49.843-7.194 77.448-3.37 3.953-7.778 2.981-6.48-4.925-3.436-7.972 3.435-15.749 4.148-20.544 3.37-16.333 3.046-20.285 1.815-6.74-.13-.454-1.49.194-15.295 20.999-23.267 31.433-18.406 19.702-4.407 1.75-7.648-3.954.713-7.064 4.277-6.286 25.47-32.405 15.36-20.092 9.917-11.6-.065-1.686h-.583L44.07 198.125l-12.055 1.555-5.185-4.86.648-7.972 2.463-2.593 20.35-13.999-.064.065Z"
+    />
+  </svg>
+);
+
+export { ClaudeAiIcon };

apps/web/src/components/ui/svgs/cursorDark.tsx

@@ -0,0 +1,12 @@
+import type { SVGProps } from "react"
+
+const CursorDark = (props: SVGProps<SVGSVGElement>) => (
+  <svg {...props} id="Ebene_1" version="1.1" viewBox="0 0 466.73 532.09">
+    <path
+      fill="#fff"
+      d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z"
+    />
+  </svg>
+)
+
+export { CursorDark }

apps/web/src/components/ui/svgs/cursorLight.tsx

@@ -0,0 +1,9 @@
+import type { SVGProps } from "react";
+
+const CursorLight = (props: SVGProps<SVGSVGElement>) => (
+  <svg {...props} id="Ebene_1" version="1.1" viewBox="0 0 466.73 532.09">
+    <path d="M457.43,125.94L244.42,2.96c-6.84-3.95-15.28-3.95-22.12,0L9.3,125.94c-5.75,3.32-9.3,9.46-9.3,16.11v247.99c0,6.65,3.55,12.79,9.3,16.11l213.01,122.98c6.84,3.95,15.28,3.95,22.12,0l213.01-122.98c5.75-3.32,9.3-9.46,9.3-16.11v-247.99c0-6.65-3.55-12.79-9.3-16.11h-.01ZM444.05,151.99l-205.63,356.16c-1.39,2.4-5.06,1.42-5.06-1.36v-233.21c0-4.66-2.49-8.97-6.53-11.31L24.87,145.67c-2.4-1.39-1.42-5.06,1.36-5.06h411.26c5.84,0,9.49,6.33,6.57,11.39h-.01Z" />
+  </svg>
+);
+
+export { CursorLight };

apps/web/src/components/ui/svgs/googleCalendar.tsx

@@ -0,0 +1,41 @@
+import type { SVGProps } from "react";
+
+const GoogleCalendar = (props: SVGProps<SVGSVGElement>) => (
+  <svg {...props} viewBox="0 0 512 512" fill="none">
+    <g clipPath="url(#clip0_5072_3766)">
+      <path
+        d="M390.736 121.264H121.264V390.736H390.736V121.264Z"
+        fill="white"
+      />
+      <path
+        d="M390.736 512L512 390.736L451.368 380.392L390.736 390.736L379.67 446.196L390.736 512Z"
+        fill="#EA4335"
+      />
+      <path
+        d="M0 390.736V471.578C0 493.912 18.088 512 40.42 512H121.264L133.714 451.368L121.264 390.736L55.198 380.392L0 390.736Z"
+        fill="#188038"
+      />
+      <path
+        d="M512 121.264V40.42C512 18.088 493.912 0 471.58 0H390.736C383.36 30.072 379.671 52.2027 379.67 66.392C379.67 80.58 383.359 98.8707 390.736 121.264C417.556 128.944 437.767 132.784 451.368 132.784C464.969 132.784 485.18 128.945 512 121.264Z"
+        fill="#1967D2"
+      />
+      <path d="M512 121.264H390.736V390.736H512V121.264Z" fill="#FBBC04" />
+      <path d="M390.736 390.736H121.264V512H390.736V390.736Z" fill="#34A853" />
+      <path
+        d="M390.736 0H40.422C18.088 0 0 18.088 0 40.42V390.736H121.264V121.264H390.736V0Z"
+        fill="#4285F4"
+      />
+      <path
+        d="M176.54 330.308C166.468 323.504 159.494 313.568 155.688 300.428L179.066 290.796C181.186 298.88 184.891 305.145 190.182 309.592C195.436 314.038 201.836 316.228 209.314 316.228C216.959 316.228 223.527 313.903 229.018 309.254C234.51 304.606 237.272 298.678 237.272 291.504C237.272 284.16 234.375 278.164 228.582 273.516C222.788 268.868 215.512 266.544 206.822 266.544H193.314V243.404H205.44C212.917 243.404 219.216 241.382 224.336 237.338C229.456 233.298 232.016 227.772 232.016 220.732C232.016 214.468 229.726 209.482 225.146 205.744C220.566 202.004 214.77 200.118 207.73 200.118C200.858 200.118 195.402 201.938 191.36 205.608C187.319 209.289 184.282 213.937 182.534 219.116L159.394 209.482C162.458 200.792 168.084 193.112 176.336 186.476C184.588 179.84 195.132 176.506 207.932 176.506C217.398 176.506 225.92 178.326 233.466 181.996C241.01 185.668 246.938 190.754 251.216 197.222C255.496 203.722 257.616 210.998 257.616 219.082C257.616 227.334 255.63 234.308 251.656 240.034C247.682 245.76 242.796 250.138 237.002 253.204V254.584C244.483 257.669 250.982 262.735 255.798 269.238C260.682 275.806 263.142 283.654 263.142 292.818C263.142 301.978 260.816 310.164 256.168 317.338C251.52 324.514 245.088 330.172 236.934 334.282C228.75 338.392 219.554 340.482 209.348 340.482C197.524 340.514 186.612 337.112 176.54 330.308ZM320.132 214.298L294.466 232.858L281.632 213.39L327.678 180.176H345.328V336.842H320.132V214.298Z"
+        fill="#4285F4"
+      />
+    </g>
+    <defs>
+      <clipPath id="clip0_5072_3766">
+        <rect width="512" height="512" fill="white" />
+      </clipPath>
+    </defs>
+  </svg>
+);
+
+export { GoogleCalendar };

deploy/docker/mirror-base-images.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 # Copy-by-digest зеркало базовых образов в Gitea Container Registry (без rebuild).
-# Требует: docker login в REGISTRY host, docker buildx.
+# Требует: docker login в REGISTRY host, docker login Docker Hub (CI: secrets.docker_hub_token), docker buildx.
 # REGISTRY=git.shx.one/<owner>  (без суффикса /evobgp-buildcache)
 #
 # Источник library-образов — Docker Hub (docker.io), не public.ecr.aws (429 Too Many Requests).

docs/releasing.md

@@ -44,13 +44,13 @@ Workflows: [.gitea/workflows/ci.yaml](../.gitea/workflows/ci.yaml), [.gitea/work
 
 ## Секреты Gitea
 
-Один PAT — **`ACTIONS_PAT`** (Settings → Actions → Secrets).
+PAT репозитория — **`ACTIONS_PAT`** (Settings → Actions → Secrets).
 
-| Право PAT | Зачем |
-|-----------|--------|
-| push tags | git tag `vX.Y.Z` на commit merge |
-| releases | Gitea Release + notes |
-| packages (Container Registry) | push образов |
+| Секрет | Зачем |
+|--------|--------|
+| `ACTIONS_PAT` | git tag `vX.Y.Z`, Gitea Release, push в Container Registry |
+| `docker_hub_token` | логин на Docker Hub при зеркале base-образов и bake (лимиты anonymous pull) |
+| `docker_hub_username` | имя пользователя Docker Hub; если пусто — `gitea.actor` |
 
 Fallback для **git tag**: `github.token`, если PAT недоступен. Push образов в Container Registry — **только `ACTIONS_PAT`** (у job token Gitea нет права packages).