Gate customer-product releases with application acceptance and hosted reuse checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

Dockerfile

@@ -54,6 +54,31 @@ RUN --mount=type=secret,id=forgejo_pypi_user,required=false \
     '
 
 
+# Application acceptance gate. This stage is required by CI before publication;
+# test tooling and test credentials are absent from the final runtime stage.
+FROM python-deps AS application-tests
+RUN --mount=type=secret,id=forgejo_pypi_user,required=false \
+    --mount=type=secret,id=forgejo_pypi_password,required=false \
+    sh -eu -c '\
+      if [ -f /run/secrets/forgejo_pypi_user ]; then \
+        export UV_INDEX_FORGEJO_USERNAME="$(cat /run/secrets/forgejo_pypi_user)"; \
+      fi; \
+      if [ -f /run/secrets/forgejo_pypi_password ]; then \
+        export UV_INDEX_FORGEJO_PASSWORD="$(cat /run/secrets/forgejo_pypi_password)"; \
+      fi; \
+      uv sync --frozen --no-install-project \
+    '
+COPY manage.py conftest.py ./
+COPY vergabe_teilnahme ./vergabe_teilnahme
+COPY static ./static
+COPY --from=assets /build/static/dist ./static/dist
+ENV DATABASE_URL=sqlite:///:memory: \
+    SECRET_KEY=application-test-only \
+    DJANGO_SETTINGS_MODULE=vergabe_teilnahme.settings.dev
+RUN .venv/bin/python manage.py collectstatic --noinput \
+    && .venv/bin/python -m pytest \
+    && .venv/bin/python manage.py makemigrations --check --dry-run
+
 # ─── Stage 3 ─── Runtime image ──────────────────────────────────────────────
 FROM python:3.12-slim-bookworm AS runtime
 
@@ -76,7 +101,6 @@ COPY --chown=app:app manage.py pyproject.toml ./
 COPY --chown=app:app vergabe_teilnahme ./vergabe_teilnahme
 COPY --chown=app:app static/src ./static/src
 COPY --chown=app:app static/vendor ./static/vendor
-COPY --chown=app:app templates ./templates
 COPY --from=assets --chown=app:app /build/static/dist ./static/dist
 
 RUN mkdir -p ./media ./staticfiles ./.issue-facade && chown -R app:app /app