Add Jenkins CI and Portainer stack for image deployment

Jenkinsfile builds and pushes both the firebase (nginx/static) and
sqlite (caddy+node) images to thinkserver:5000, guarded to main only.
docker/portainer-stack.yml deploys the prebuilt sqlite image from the
registry behind the external TLS-terminating nginx.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Jenkinsfile

@@ -49,13 +49,21 @@ pipeline {
         checkout scm
         script {
           env.SHORT_SHA = sh(returnStdout: true, script: 'git rev-parse --short=8 HEAD').trim()
-          echo "Building tag ${env.SHORT_SHA} (build #${env.BUILD_NUMBER})"
+          // Only build/push on main. BRANCH_NAME is set by Multibranch jobs; it
+          // is unset in a plain "Pipeline from SCM" job, which already only ever
+          // checks out main, so treat unset as main too.
+          env.IS_MAIN = (env.BRANCH_NAME == null || env.BRANCH_NAME == 'main').toString()
+          if (env.IS_MAIN != 'true') {
+            echo "Branch '${env.BRANCH_NAME}' is not main — skipping image build/push."
+          } else {
+            echo "Building tag ${env.SHORT_SHA} (build #${env.BUILD_NUMBER})"
+          }
         }
       }
     }
 
     stage('Registry login') {
-      when { expression { return params.REGISTRY_AUTH } }
+      when { allOf { expression { env.IS_MAIN == 'true' }; expression { return params.REGISTRY_AUTH } } }
       steps {
         withCredentials([usernamePassword(credentialsId: 'thinkserver-registry',
                                            usernameVariable: 'REG_USER',
@@ -66,6 +74,7 @@ pipeline {
     }
 
     stage('Build firebase image') {
+      when { expression { env.IS_MAIN == 'true' } }
       steps {
         // Firebase config is compiled into the static bundle, so it must exist
         // at build time. Inject .env.local from the Jenkins secret file, then
@@ -83,6 +92,7 @@ pipeline {
     }
 
     stage('Build sqlite image') {
+      when { expression { env.IS_MAIN == 'true' } }
       steps {
         // Server/SQLite build. BuildKit is required (syntax directive + cache
         // mount in docker/Dockerfile). Context is the repo root.
@@ -97,7 +107,7 @@ pipeline {
     }
 
     stage('Tag latest') {
-      when { expression { return params.PUSH_LATEST } }
+      when { allOf { expression { env.IS_MAIN == 'true' }; expression { return params.PUSH_LATEST } } }
       steps {
         sh '''
           docker tag "$FIREBASE_IMAGE:$SHORT_SHA" "$FIREBASE_IMAGE:latest"
@@ -107,6 +117,7 @@ pipeline {
     }
 
     stage('Push') {
+      when { expression { env.IS_MAIN == 'true' } }
       steps {
         sh '''
           docker push "$FIREBASE_IMAGE:$SHORT_SHA"