fix(crawler): walk list pages incrementally; stop on empty page (0.45.1)

The pre-built `1..=parse_last_page` queue silently broke whenever the
configured CRAWLER_START_URL lacked a `/N/` path segment: page_url
returned the input unchanged, every "next" page re-fetched page 1, and
the dedup set caught the duplicates as a flood of "skip already-seen
key in this run" debug lines. The walker now increments next_page on
each batch and terminates when parse_manga_list_from yields an empty
list (the `#logo` sentinel still converts unrendered pages into
transient errors, so an Ok(vec![]) is a real end-of-index signal).

parse_last_page and build_page_order are deleted along with their
unit tests; they have no callers under the new model. page_url and
the page-1 HTML cache from discover() are retained as-is.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   test-backend:
     runs-on: ubuntu-latest
+    container:
+      image: rust:1-slim
     services:
       postgres:
         image: postgres:16-alpine
@@ -26,18 +28,10 @@ jobs:
       DATABASE_URL: postgres://mangalord:mangalord@postgres:5432/mangalord
     steps:
       - uses: actions/checkout@v4
-      # ubuntu-latest has node (so JS actions like checkout/cache run) but no
+      - name: Install build deps
-      # Rust. We intentionally avoid `container: rust:1-slim` because act_runner
-      # runs JS actions with node *inside* the job container, and the slim Rust
-      # image ships no node (checkout would fail with exit 127).
-      - name: Install Rust + build deps
         run: |
-          set -eu
+          apt-get update
-          SUDO=""; [ "$(id -u)" = "0" ] || SUDO="sudo"
+          apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates
-          $SUDO apt-get update
-          $SUDO apt-get install -y --no-install-recommends pkg-config libssl-dev ca-certificates curl
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Cache cargo registry and target
         uses: actions/cache@v4
         with:
@@ -72,17 +66,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test-backend, test-frontend]
     # PRs only run the test jobs; build + deploy are reserved for
-    # post-merge pushes to main.
+    # post-merge pushes to main. Without this gate every PR would push
+    # a tagged image to the registry and SSH-deploy to prod.
     if: github.event_name != 'pull_request'
-    # Build on the host docker daemon directly (docker-outside-of-docker):
-    # the runner shares the deploy host's daemon, so a plain `docker build`
-    # reuses the host's layer cache and avoids buildx's docker-container
-    # driver + the gha cache exporter — neither works against this single-host
-    # act_runner, and there is no in-job daemon socket unless we mount it.
-    container:
-      image: docker.gitea.com/runner-images:ubuntu-latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
     outputs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
       version: ${{ steps.meta.outputs.version }}
@@ -101,32 +87,48 @@ jobs:
           echo "image_tag=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
-      - name: Build & push backend + frontend
+      - uses: docker/setup-buildx-action@v3
-        env:
+
-          REGISTRY_URL: ${{ secrets.REGISTRY_URL }}
+      - name: docker login
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+        uses: docker/login-action@v3
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        with:
-          IMAGE_TAG: ${{ steps.meta.outputs.image_tag }}
+          registry: ${{ secrets.REGISTRY_URL }}
-          VERSION: ${{ steps.meta.outputs.version }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
-        run: |
+          password: ${{ secrets.REGISTRY_PASSWORD }}
-          set -eu
+
-          echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" -u "$REGISTRY_USERNAME" --password-stdin
+      - name: Build & push backend
-          for svc in backend frontend; do
+        uses: docker/build-push-action@v5
-            img="$REGISTRY_URL/mangalord-$svc"
+        with:
-            docker build -t "$img:$IMAGE_TAG" -t "$img:latest" -t "$img:$VERSION" "./$svc"
+          context: ./backend
-            for tag in "$IMAGE_TAG" latest "$VERSION"; do docker push "$img:$tag"; done
+          push: true
-          done
+          tags: |
-          docker logout "$REGISTRY_URL"
+            ${{ secrets.REGISTRY_URL }}/mangalord-backend:latest
+            ${{ secrets.REGISTRY_URL }}/mangalord-backend:${{ steps.meta.outputs.image_tag }}
+            ${{ secrets.REGISTRY_URL }}/mangalord-backend:${{ steps.meta.outputs.version }}
+          cache-from: type=gha,scope=backend
+          cache-to: type=gha,mode=max,scope=backend
+
+      - name: Build & push frontend
+        uses: docker/build-push-action@v5
+        with:
+          context: ./frontend
+          push: true
+          tags: |
+            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:latest
+            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:${{ steps.meta.outputs.image_tag }}
+            ${{ secrets.REGISTRY_URL }}/mangalord-frontend:${{ steps.meta.outputs.version }}
+          cache-from: type=gha,scope=frontend
+          cache-to: type=gha,mode=max,scope=frontend
 
   deploy:
     runs-on: ubuntu-latest
     needs: build-and-push
     if: github.event_name != 'pull_request'
     # Single-host deploy: the runner lives on the same box as the stack, so we
-    # drive the host docker daemon directly (the job mounts the host docker
+    # drive the host docker daemon directly (act_runner shares its socket via
-    # socket) instead of SSHing out. The compose dir is bind-mounted at its
+    # `docker_host: "-"`) instead of SSHing out. The compose dir is bind-mounted
-    # REAL host path so compose's relative bind-mounts (./mangalord/...,
+    # at its REAL host path so compose's relative bind-mounts (./mangalord/...,
-    # ./Caddyfile) resolve; both paths must be in the runner's
+    # ./Caddyfile) resolve; this requires `/mnt/ssd/docker-data` in the runner's
     # container.valid_volumes. The central compose references the images as
     # registry.mc02.dev/mangalord-*:${MANGALORD_TAG:-latest}, so we only pull
     # and recreate the two mangalord services at the freshly built SHA.
@@ -134,7 +136,6 @@ jobs:
       image: docker:cli
       volumes:
         - /mnt/ssd/docker-data:/mnt/ssd/docker-data
-        - /var/run/docker.sock:/var/run/docker.sock
     steps:
       - name: Deploy to the local stack
         working-directory: /mnt/ssd/docker-data