🚀 ci(picture): add picture app to CI/CD deployment pipeline

- Add picture-backend and picture-web to CI Docker build matrix
- Add picture services to staging deployment workflow
- Add picture-backend to production deployment workflow
- Create Dockerfile and docker-entrypoint.sh for picture-web
- Fix picture-backend Dockerfile port (3003→3006) and health endpoint
- Add picture routes to Caddyfile.staging
- Add REPLICATE_API_TOKEN and MANA_CORE_SERVICE_KEY env vars

docker-compose.staging.yml

@@ -8,6 +8,7 @@
 #   1. Copy the service block from docker-compose.staging.full.yml
 #   2. Add corresponding health check in .github/workflows/cd-staging.yml
 #   3. Add service to workflow_dispatch options in cd-staging.yml
+#   4. Add Caddy routes to docker/caddy/Caddyfile.staging
 
 services:
   # ============================================
@@ -83,7 +84,7 @@ services:
       # Frontend URL for password reset and email verification links
       FRONTEND_URL: ${FRONTEND_URL:-https://staging.manacore.ai}
       # CORS - Allow all staging web app origins (HTTPS domains + localhost for dev)
-      CORS_ORIGINS: https://chat.staging.manacore.ai,https://staging.manacore.ai,https://calendar.staging.manacore.ai,https://clock.staging.manacore.ai,https://todo.staging.manacore.ai,http://localhost:3000,http://localhost:5173,http://localhost:5186,http://localhost:5187,http://localhost:5188
+      CORS_ORIGINS: https://chat.staging.manacore.ai,https://staging.manacore.ai,https://calendar.staging.manacore.ai,https://clock.staging.manacore.ai,https://todo.staging.manacore.ai,https://picture.staging.manacore.ai,http://localhost:3000,http://localhost:5173,http://localhost:5175,http://localhost:5186,http://localhost:5187,http://localhost:5188
     ports:
       - "3001:3001"
     healthcheck:
@@ -189,6 +190,7 @@ services:
       CALENDAR_API_URL: https://calendar-api.staging.manacore.ai
       CLOCK_API_URL: https://clock-api.staging.manacore.ai
       CONTACTS_API_URL: https://contacts-api.staging.manacore.ai
+      PICTURE_API_URL: https://picture-api.staging.manacore.ai
     ports:
       - "5173:5173"
     healthcheck:
@@ -411,6 +413,85 @@ services:
         max-size: "10m"
         max-file: "3"
 
+  # ============================================
+  # Picture App
+  # ============================================
+
+  picture-backend:
+    image: ${DOCKER_REGISTRY:-ghcr.io/memo-2023}/picture-backend:${PICTURE_VERSION:-latest}
+    container_name: picture-backend-staging
+    restart: unless-stopped
+    depends_on:
+      mana-core-auth:
+        condition: service_healthy
+      postgres:
+        condition: service_healthy
+    environment:
+      NODE_ENV: staging
+      PORT: 3006
+      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD}@postgres:5432/picture
+      DB_HOST: postgres
+      DB_PORT: 5432
+      DB_USER: ${POSTGRES_USER:-postgres}
+      MANA_CORE_AUTH_URL: http://mana-core-auth:3001
+      CORS_ORIGINS: https://picture.staging.manacore.ai,https://staging.manacore.ai,http://localhost:5175,http://localhost:5173
+      # Replicate API for AI image generation
+      REPLICATE_API_TOKEN: ${REPLICATE_API_TOKEN}
+      # S3/MinIO storage
+      S3_ENDPOINT: ${S3_ENDPOINT}
+      S3_REGION: ${S3_REGION}
+      S3_ACCESS_KEY: ${S3_ACCESS_KEY}
+      S3_SECRET_KEY: ${S3_SECRET_KEY}
+      MANACORE_STORAGE_PUBLIC_URL: ${MANACORE_STORAGE_PUBLIC_URL}
+      # Credit system
+      MANA_CORE_SERVICE_KEY: ${MANA_CORE_SERVICE_KEY}
+      APP_ID: picture
+    ports:
+      - "3006:3006"
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3006/api/v1/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - manacore-network
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  picture-web:
+    image: ${DOCKER_REGISTRY:-ghcr.io/memo-2023}/picture-web:${PICTURE_WEB_VERSION:-latest}
+    container_name: picture-web-staging
+    restart: unless-stopped
+    depends_on:
+      picture-backend:
+        condition: service_healthy
+    environment:
+      NODE_ENV: staging
+      PORT: 5175
+      # Runtime config generation (12-factor pattern)
+      # These vars are used by docker-entrypoint.sh to generate /config.json
+      BACKEND_URL: https://picture-api.staging.manacore.ai
+      AUTH_URL: https://auth.staging.manacore.ai
+    ports:
+      - "5175:5175"
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:5175/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - manacore-network
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
 # ============================================
 # Networks
 # ============================================