chore: import upstream snapshot with attribution

.github/workflows/docker-docr.yml

@@ -0,0 +1,125 @@
+name: CD - Docker - DOCR
+
+on:
+  workflow_dispatch:
+    inputs:
+      site_tld:
+        required: true
+        type: choice
+        description: 'Input: The site tld (variant) to build'
+        options:
+          - dev
+          - org
+        default: 'dev'
+      app:
+        required: true
+        type: string
+        description: 'Input: The app (component) to build'
+        default: 'api'
+      show_upcoming_changes:
+        required: false
+        type: string
+        description: 'Input: Show upcoming changes flag (true/false)'
+        default: 'false'
+  workflow_call:
+    inputs:
+      site_tld:
+        required: true
+        type: string
+        description: 'Input: The site tld (variant) to build'
+      app:
+        required: true
+        type: string
+        description: 'Input: The app (component) to build'
+      show_upcoming_changes:
+        required: false
+        type: string
+        description: 'Input: Show upcoming changes flag (true/false)'
+        default: 'false'
+    secrets:
+      DIGITALOCEAN_ACCESS_TOKEN:
+        required: true
+        description: 'DigitalOcean API token for registry authentication'
+      DOCR_NAME:
+        required: true
+        description: 'DigitalOcean Container Registry name'
+      SENTRY_AUTH_TOKEN:
+        required: false
+        description: 'Sentry auth token for source map upload (api app only)'
+    outputs:
+      tagname:
+        description: 'Output: The tagname for the image built'
+        value: ${{ jobs.build.outputs.tagname }}
+
+jobs:
+  build:
+    name: Build & Push
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      tagname: ${{ steps.tagname.outputs.tagname }}
+
+    steps:
+      - name: Checkout Source Files
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Create a tagname
+        id: tagname
+        run: |
+          tagname=$(git rev-parse --short HEAD)-$(date +%Y%m%d)-$(date +%H%M)
+          echo "tagname=$tagname" >> "$GITHUB_ENV"
+          echo "tagname=$tagname" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+
+      - name: Install doctl
+        uses: digitalocean/action-doctl@3cb3953159719656269e044e0e24ca16dd2a690f # v2.5.2
+        with:
+          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+
+      - name: Log in to DigitalOcean Container Registry with short-lived credentials
+        run: doctl registry login --expiry-seconds 1200
+
+      - name: Build & Push Image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: docker/${{ inputs.app }}/Dockerfile
+          push: true
+          build-args: |
+            SHOW_UPCOMING_CHANGES=${{ inputs.show_upcoming_changes }}
+          tags: |
+            registry.digitalocean.com/${{ secrets.DOCR_NAME }}/${{ inputs.site_tld }}/learn-${{ inputs.app }}:${{ env.tagname }}
+            registry.digitalocean.com/${{ secrets.DOCR_NAME }}/${{ inputs.site_tld }}/learn-${{ inputs.app }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # TODO(o11y): source-map upload + release marking disabled pending a
+      # follow-up PR with a stable release-id scheme. Also fix the upload path
+      # when re-enabling: the image ships /home/node/fcc/api/src (dist flattened
+      # by the COPY in docker/api/Dockerfile), so `docker cp .../fcc/api` yields
+      # sentry-dist/api/src — the old upload pointed at sentry-dist/api/dist,
+      # which never exists (silent no-op, so maps never uploaded). Path below is
+      # pre-corrected to sentry-dist/api/src. See
+      # .scratchpad/o11y-cutover-review-2026-07-10.md.
+      # - name: Extract API dist for Sentry source maps
+      #   if: inputs.app == 'api'
+      #   run: |
+      #     IMAGE="registry.digitalocean.com/${{ secrets.DOCR_NAME }}/${{ inputs.site_tld }}/learn-${{ inputs.app }}:${{ env.tagname }}"
+      #     docker pull "$IMAGE"
+      #     container_id=$(docker create "$IMAGE")
+      #     mkdir -p sentry-dist
+      #     docker cp "$container_id:/home/node/fcc/api" sentry-dist/
+      #     docker rm "$container_id"
+      #
+      # - name: Upload source maps to Sentry (unfinalized)
+      #   if: inputs.app == 'api'
+      #   env:
+      #     SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      #     SENTRY_ORG: freecodecamp
+      #     SENTRY_PROJECT: api-fastify
+      #   run: |
+      #     npx --yes @sentry/cli@3.6.0 releases new "${{ env.tagname }}"
+      #     npx --yes @sentry/cli@3.6.0 sourcemaps upload --release "${{ env.tagname }}" sentry-dist/api/src