ci(dev): apply same registry-auth and tag-pattern fixes as build-prod

- username: admin (was gitea.repository_owner — the org name, which fails
  Gitea's per-scope token exchange during buildkit blob HEAD requests)
- :latest only on semver tag pushes (was every push to dev — dev pushes
  don't carry semver tags so :latest just won't be re-emitted, which is
  the right behavior for SHA-tracked dev deploys)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.farhoodlabs/.github/workflows/build-dev.yml

@@ -30,7 +30,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: git.farh.net
-          username: ${{ gitea.repository_owner }}
+          username: admin
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Docker meta
@@ -39,9 +39,9 @@ jobs:
         with:
           images: git.farh.net/farhoodlabs/paperclip-dev
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
             type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6

.github/workflows/build-dev.yml

@@ -30,7 +30,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: git.farh.net
-          username: ${{ gitea.repository_owner }}
+          username: admin
           password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Docker meta
@@ -39,9 +39,9 @@ jobs:
         with:
           images: git.farh.net/farhoodlabs/paperclip-dev
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
             type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6