ci: add isolated testing-branch Docker build workflow

Adds .gitea/workflows/testing.yml, which builds and pushes only the
gitea.it-drui.de/viewit/kx-bridge:testing (+ :testing-<shortsha>) image on a
push to the `testing` branch.

Strictly isolated from nightly/master by construction:
- triggers only on push to `testing` (plus workflow_dispatch), no cron
- contains no git push / tag / release step, so it never writes back to any
  branch (unlike nightly.yml, which resets NIGHTLY_CHANGELOG.md back to
  nightly)
- uses its own :testing* image tags, never overwriting :nightly / :latest

Conversely, the existing workflows don't react to testing pushes:
nightly.yml is bound to the nightly branch, release.yml to v* tags,
pr-check.yml to PRs against nightly. So a testing push can't trigger any of
them either.

.gitea/workflows/testing.yml

@@ -0,0 +1,96 @@
+name: Testing Build
+
+# Isolierter Test-Kanal: baut ausschließlich das Docker-Image
+# gitea.it-drui.de/viewit/kx-bridge:testing (+ :testing-<shortsha>).
+#
+# Bewusst KEIN Gitea-Release, KEIN Tag, KEIN Rück-Push in irgendeinen Branch -
+# damit ein Push nach `testing` niemals nightly oder master berührt (und
+# umgekehrt: nightly.yml/release.yml/pr-check.yml triggern nicht auf
+# `testing`-Pushes, da sie an nightly / v*-Tags / PRs-gegen-nightly gebunden
+# sind). Der Workflow schreibt nie ins Repo zurück.
+
+on:
+  push:
+    branches:
+      - testing
+    paths:
+      - '**.py'
+      - 'Dockerfile'
+      - 'requirements.txt'
+      - 'web/**'
+      - 'data/**'
+      - '.gitea/workflows/testing.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: server-runner
+    steps:
+      - name: Checkout
+        run: |
+          if [ -d .git ]; then
+            git fetch origin testing
+            git reset --hard origin/testing
+            git clean -fd
+          else
+            git clone --branch testing https://gitea.it-drui.de/viewit/KX-Bridge-Release.git .
+          fi
+
+      - name: Install Docker CLI
+        run: |
+          if ! command -v docker >/dev/null 2>&1; then
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "x86_64" ]; then
+              DARCH="x86_64"
+              BARCH="amd64"
+            else
+              DARCH="aarch64"
+              BARCH="arm64"
+            fi
+            wget -qO- "https://download.docker.com/linux/static/stable/${DARCH}/docker-27.5.1.tgz" \
+              | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+            chmod +x /usr/local/bin/docker
+            mkdir -p /usr/local/lib/docker/cli-plugins
+            wget -qO /usr/local/lib/docker/cli-plugins/docker-buildx \
+              "https://github.com/docker/buildx/releases/download/v0.23.0/buildx-v0.23.0.linux-${BARCH}"
+            chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
+          fi
+          docker version --format '{{.Client.Version}}'
+
+      - name: Set up QEMU
+        run: |
+          docker run --rm --privileged tonistiigi/binfmt:latest --install all
+
+      - name: Set up buildx
+        run: |
+          docker buildx inspect kxbuilder 2>/dev/null || \
+            docker buildx create --name kxbuilder --use
+          docker buildx use kxbuilder
+
+      - name: Login to Gitea registry
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | \
+            docker login gitea.it-drui.de -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Compute testing version
+        run: |
+          # Reiner Commit-SHA-Suffix - keine Tag-Zähllogik, keine Stable-Tag-
+          # Abhängigkeit, kein Commit. Nur die VERSION-Datei im Arbeitsverzeichnis.
+          VERSION="testing-$(git rev-parse --short HEAD)"
+          echo "VERSION=${VERSION}" > /tmp/testing_version.env
+          echo "Computed testing version: ${VERSION}"
+
+      - name: Build & push (amd64 + arm64)
+        run: |
+          . /tmp/testing_version.env
+          # VERSION-Datei nur im Arbeitsverzeichnis für den Docker-Build setzen
+          # (KEIN Commit, KEIN Push).
+          echo "$VERSION" > VERSION
+          docker buildx build \
+            --platform linux/amd64,linux/arm64,linux/arm/v7 \
+            --push \
+            --provenance=false \
+            --no-cache \
+            -t "gitea.it-drui.de/viewit/kx-bridge:testing" \
+            -t "gitea.it-drui.de/viewit/kx-bridge:${VERSION}" \
+            .