feat: add Docker Hub image tags and update CI workflows

- docker-compose.yml: add image: kalekber/libnovel-{backend,runner,ui,caddy}:${GIT_TAG} alongside each build: block — prod pulls from Docker Hub, dev builds locally with just build
- justfile: add push, build-push, pull-images, pull-infra recipes
- ci-v3.yaml: fix v3/ path references, add caddy job, add registry layer cache
- release-v3.yaml: fix v3/ path references, add caddy job, simplify tag pattern to semver (v*), add layer cache, caddy added to release gate

justfile

@@ -44,9 +44,9 @@ down-volumes:
 ps:
     {{doppler}} docker compose ps
 
-# ── Build ─────────────────────────────────────────────────────────────────────
+# ── Build & publish ───────────────────────────────────────────────────────────
 
-# Build (or rebuild) all images
+# Build (or rebuild) all custom images locally
 build:
     {{doppler}} docker compose build
 
@@ -54,9 +54,20 @@ build:
 build-svc svc:
     {{doppler}} docker compose build {{svc}}
 
-# Pull latest base images
-pull:
-    {{doppler}} docker compose pull
+# Push all custom images to Docker Hub (requires docker login)
+push:
+    {{doppler}} docker compose push backend runner ui caddy
+
+# Build then push all custom images
+build-push: build push
+
+# Pull all images from Docker Hub (uses GIT_TAG from Doppler)
+pull-images:
+    {{doppler}} docker compose pull backend runner ui caddy
+
+# Pull all third-party base images (minio, pocketbase, etc.)
+pull-infra:
+    {{doppler}} docker compose pull minio pocketbase meilisearch valkey postgres crowdsec watchtower
 
 # ── Logs ─────────────────────────────────────────────────────────────────────