fix(ci): deploy by SHA tag, not mutable :latest

Deploy now pulls images pinned to $CI_COMMIT_SHA instead of :latest,
eliminating race-condition deployments where a concurrent pipeline
overwrites the mutable latest tag before deploy runs.

Changes:
- docker-compose.yml: image tags use ${IMAGE_TAG:-latest} env var
- deploy step: IMAGE_TAG=$CI_COMMIT_SHA docker compose pull + up
- scp docker-compose.yml to VPS before running deploy commands

.gitlab-ci.yml

@@ -91,6 +91,7 @@ deploy-vps:
     - ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
   script:
     # Login to GitLab Container Registry, pull images, update docker-compose, restart
+    - scp infra/docker/docker-compose.yml "$SSH_HOST:$APP_DIR/infra/docker/docker-compose.yml"
     - |
       ssh "$SSH_HOST" "
         set -eu
@@ -100,19 +101,18 @@ deploy-vps:
         echo '→ Logging in to GitLab Container Registry...'
         echo '$CI_JOB_TOKEN' | docker login $CI_REGISTRY -u '$CI_REGISTRY_USER' --password-stdin
 
-        echo '→ Updating docker-compose image references...'
+        echo '→ Pulling SHA-pinned images...'
-        echo '→ Pulling latest images...'
+        IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml pull
-        docker compose -f infra/docker/docker-compose.yml pull
 
         echo '→ Restarting containers (recreates if image changed)...'
-        docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
+        IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
 
         # Force restart proxy to pick up new upstream DNS IPs.
         # Docker's DNS changes when backend containers are recreated,
         # but nginx only resolves upstream hostnames at startup. Without this,
         # nginx keeps pointing to stale container IPs → 502 Bad Gateway.
         echo '→ Ensuring proxy container is restarted (nginx upstream DNS refresh)...'
-        docker compose -f infra/docker/docker-compose.yml restart proxy
+        IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml restart proxy
 
         echo '→ Cleaning up...'
         docker image prune -f

infra/docker/docker-compose.yml

@@ -4,7 +4,7 @@ services:
   # Nginx Reverse Proxy + Frontend Static Files
   # Routes /api and /ws to backend, serves frontend WASM directly
   proxy:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-proxy:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-proxy:${IMAGE_TAG:-latest}
     container_name: imphenbot-proxy
     restart: unless-stopped
     labels:
@@ -29,7 +29,7 @@ services:
 
   # Backend Service (REST API + WebSocket)
   backend:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-backend:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-backend:${IMAGE_TAG:-latest}
     container_name: imphenbot-backend
     restart: unless-stopped
     env_file:
@@ -52,7 +52,7 @@ services:
 
   # Discord Gateway Service (Event capture and processing — no HTTP)
   discord-gateway:
-    image: registry.gitlab.com/mytheclipse-group/gmw/bete-discord-gateway:latest
+    image: registry.gitlab.com/mytheclipse-group/gmw/bete-discord-gateway:${IMAGE_TAG:-latest}
     container_name: imphenbot-discord-gateway
     restart: unless-stopped
     env_file: