fix(ci): fix sidebar tests + add registry publish + prod compose

- sidebar.test: expand category before asserting on module names
  (categories are collapsed by default since UI-Umbau)
- ci.yml: replace build-deploy with publish job that pushes images
  to git.vicolab.de container registry
- docker-compose.prod.yml: pull-only compose for server deployments
  using registry images

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/components/layout/sidebar.test.tsx

@@ -140,6 +140,12 @@ describe('Sidebar', () => {
     const Sidebar = await importSidebar();
     render(<Sidebar />);
 
+    // Categories are collapsed by default — wait for category header, then expand
+    await waitFor(() => {
+      expect(screen.getByText('Domain Tools')).toBeInTheDocument();
+    });
+    await userEvent.click(screen.getByText('Domain Tools'));
+
     await waitFor(() => {
       expect(screen.getByText('Domaincheck')).toBeInTheDocument();
     });
@@ -156,8 +162,9 @@ describe('Sidebar', () => {
     const Sidebar = await importSidebar();
     const { rerender } = render(<Sidebar />);
 
+    // Wait for category header to confirm initial fetch completed
     await waitFor(() => {
-      expect(screen.getByText('Domaincheck')).toBeInTheDocument();
+      expect(screen.getByText('Domain Tools')).toBeInTheDocument();
     });
 
     const initialCallCount = (globalThis.fetch as ReturnType<typeof vi.fn>).mock.calls.length;