ci: trigger Watchtower instead of waiting for its poll

The poll is the fallback, not the mechanism. It is 30s on staging but 300s
on production, so a green run could sit five minutes ahead of the deploy it
claimed to have made -- the smoke job was absorbing that wait.

Copied from easyDent verbatim, including the soft failure: an unset secret
or an unreachable API logs and falls back to the poll rather than failing
the build. That matters right now because production has no Watchtower HTTP
API yet, so the production URL will do nothing until the infra stack there
is updated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpTYCBLH58XzrM7n3xPJ5N

.gitea/workflows/build.yml

@@ -108,6 +108,25 @@ jobs:
         run: |
           docker push "${REGISTRY_HOST}/${PAGE_FETCHER_API_IMAGE}:${IMAGE_TAG}"
 
+      # Watchtower's poll is the fallback, not the mechanism: 30s on staging but 300s on
+      # production, so without this a green run can sit five minutes ahead of the deploy it
+      # claims to have made. Copied from easyDent, including the soft failure -- an unset
+      # secret or an unreachable API must degrade to the poll, never fail the build.
+      - name: Trigger Watchtower redeploy
+        env:
+          URL_STAGING: ${{ secrets.WATCHTOWER_URL_STAGING }}
+          URL_PRODUCTION: ${{ secrets.WATCHTOWER_URL_PRODUCTION }}
+          TOKEN: ${{ secrets.WATCHTOWER_TOKEN }}
+        run: |
+          if [ "${IMAGE_TAG}" = "production" ]; then URL="${URL_PRODUCTION}"; else URL="${URL_STAGING}"; fi
+          if [ -n "${URL}" ] && [ -n "${TOKEN}" ]; then
+            echo "Triggering Watchtower at ${URL}"
+            curl -sf -m 30 -H "Authorization: Bearer ${TOKEN}" "${URL}" && echo "  -> redeploy triggered" \
+              || echo "  -> trigger failed; Watchtower will still pick it up on the next poll"
+          else
+            echo "Watchtower push-trigger not configured (WATCHTOWER_* secrets unset); relying on the poll interval."
+          fi
+
       - name: Reclaim disk space (keep recent build cache)
         if: always()
         run: |