ci: Switch to Woodpecker CI pipeline

Replaces Gitea Actions with Woodpecker CI config.

Pipeline:
- CI: typecheck backend, build all 3 frontends (all branches)
- CD: build 4 Docker images, deploy to k8s (master only)

Required secrets in Woodpecker:
- registry_username
- registry_password
- kubeconfig_data (base64 encoded)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/.env

@@ -1,17 +1,30 @@
 PORT=3010
 NODE_ENV=development
 
-# Database
-DATABASE_URL=postgresql://dutchie:dutchie_local_pass@localhost:54320/dutchie_menus
+# =============================================================================
+# CannaiQ Database (dutchie_menus) - PRIMARY DATABASE
+# =============================================================================
+# This is where all schema migrations run and where canonical tables live.
+# All CANNAIQ_DB_* variables are REQUIRED - connection will fail if missing.
+CANNAIQ_DB_HOST=localhost
+CANNAIQ_DB_PORT=54320
+CANNAIQ_DB_NAME=dutchie_menus
+CANNAIQ_DB_USER=dutchie
+CANNAIQ_DB_PASS=dutchie_local_pass
 
-# MinIO (connecting to Docker from host)
-MINIO_ENDPOINT=localhost
-MINIO_PORT=9020
-MINIO_USE_SSL=false
-MINIO_ACCESS_KEY=minioadmin
-MINIO_SECRET_KEY=minioadmin
-MINIO_BUCKET=dutchie
-MINIO_PUBLIC_ENDPOINT=http://localhost:9020
+# =============================================================================
+# Legacy Database (dutchie_legacy) - READ-ONLY SOURCE
+# =============================================================================
+# Used ONLY by ETL scripts to read historical data.
+# NEVER run migrations against this database.
+LEGACY_DB_HOST=localhost
+LEGACY_DB_PORT=54320
+LEGACY_DB_NAME=dutchie_legacy
+LEGACY_DB_USER=dutchie
+LEGACY_DB_PASS=dutchie_local_pass
+
+# Local image storage (no MinIO per CLAUDE.md)
+LOCAL_IMAGES_PATH=./public/images
 
 # JWT
 JWT_SECRET=your-secret-key-change-in-production