web: build image in CI, pull it in Terraform instead of building locally

templates/web's docker_image resource used a `build` block, so every
first-use of a new Dockerfile hash triggered a from-scratch build
(including the ~15-20min Rust toolchain compile) right at `terraform
apply` time - i.e. while someone was waiting to create a workspace.

Adds a build-web-image job to coder-templates.yml that builds and pushes
git.octoturge.com/octo-tech/profiles-web:<dockerfile-sha1> to this
instance's container registry, tagged identically to what
docker_image.web now computes and pulls (no build block). provision now
depends on build-web-image so a template never gets pushed pointing at
an image that isn't there yet. Skips the build entirely if that tag's
already in the registry, so an unrelated templates/* change doesn't
pay any cost.

Runs on a new dedicated "docker-build" runner (profiles-web-build),
scoped to just this repo via a repo-level registration token, with
host Docker socket access - deliberately not added to the existing
shared runner-1, which has no such access and stays untouched. Repo is
public, so the pulled image needs no registry auth; the push does, via
a new GITEA_PACKAGE_TOKEN repo secret (write:package scope).

Since CI and this Coder deployment share the same Docker daemon, the
"pull" is normally a same-host cache hit, not a real network pull.

Verified: `terraform validate` passes against the updated
templates/web/main.tf (run directly inside the coder-server container,
which has terraform embedded).

templates/web/main.tf

@@ -193,16 +193,18 @@ resource "docker_volume" "home_volume" {
   }
 }
 
-# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
-# directory, so no external registry push is required. The tag embeds the
-# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
-# while an unchanged Dockerfile reuses the cached image.
+# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
+# The image is built and pushed by .gitea/workflows/coder-templates.yml's
+# build-web-image job, tagged with the same Dockerfile hash this resource
+# computes - so a Dockerfile edit always resolves to the matching image, and
+# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
+# it, and this pull is normally a same-host cache hit rather than a real
+# network pull, since CI and this Coder deployment share one Docker daemon).
+# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
+# create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
-  build {
-    context = path.module
-  }
+  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
   keep_locally = true
 }