ci: auto-bump prod chicorytv tag in server-management on v* release

Adds a bump-prod-compose job that runs only on v* tags, after build. It
clones server-management via a scoped write deploy key (SERVERMGMT_DEPLOY_KEY
secret), rewrites the pinned ersatztv image tag in
docker/bumblebee/stacks/media-servers/compose.yaml to the released version,
and pushes. The existing per-stack Gitea->Komodo webhook then redeploys prod,
and because the ersatztv service block changed, the #553 pre-deploy hook takes
an ErsatzTV PBS backup first.

Automates the documented "current practice" prod bump (docs/Docker/ErsatzTV.md)
while keeping prod pinned + backed up — deliberately NOT a floating :prod /
watchtower gate (server-management#481).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -280,3 +280,40 @@ jobs:
             echo "===== container logs (tail) ====="; docker logs "$NAME" 2>&1 | tail -n 40 || true
             exit 1
           fi
+
+  # On a prod release (v* tag), auto-bump the pinned ersatztv image tag in the
+  # server-management media-servers compose and push. The existing per-stack
+  # Gitea->Komodo webhook then redeploys prod, and because the ersatztv service
+  # block changed, the #553 pre-deploy hook takes an ErsatzTV PBS backup first.
+  # This automates the documented "current practice" bump (docs/Docker/ErsatzTV.md)
+  # while keeping prod pinned + backed up (NOT a floating :prod / watchtower gate).
+  bump-prod-compose:
+    name: Bump prod compose tag (server-management)
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - name: Bump ersatztv prod tag in media-servers compose
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.SERVERMGMT_DEPLOY_KEY }}" > ~/.ssh/id_deploy
+          chmod 600 ~/.ssh/id_deploy
+          ssh-keyscan -p 22 192.168.1.95 >> ~/.ssh/known_hosts 2>/dev/null
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_deploy -o IdentitiesOnly=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          rm -rf /tmp/svrmgmt
+          git clone --depth 1 ssh://gitea@192.168.1.95:22/timothy/server-management.git /tmp/svrmgmt
+          cd /tmp/svrmgmt
+          FILE="docker/bumblebee/stacks/media-servers/compose.yaml"
+          sed -i -E "s|(image: 192\.168\.1\.95:3000/timothy/ersatztv:)[^[:space:]]+|\1${VERSION}|" "$FILE"
+          if git diff --quiet "$FILE"; then
+            echo "media-servers compose already pins ersatztv:${VERSION}; nothing to do"
+            exit 0
+          fi
+          git config user.name "ersatztv-ci"
+          git config user.email "ci@tblindustries.be"
+          git add "$FILE"
+          git commit -m "chore(ersatztv): bump prod chicorytv to ${VERSION} [ci auto-deploy]"
+          git push origin HEAD:master
+          echo "Pushed prod bump -> ersatztv:${VERSION}; media-servers webhook will deploy with pre-deploy backup."