infra: stack Traefik (Swarm), exemplos de env, CI GitHub Actions e ajuste workspace pnpm

.github/workflows/ci-cd-web-desktop.yml

@@ -0,0 +1,97 @@
+name: CI/CD Web + Desktop
+
+on:
+  push:
+    branches: [ main ]
+    tags:
+      - 'v*.*.*'
+
+env:
+  APP_DIR: /srv/apps/sistema
+  VPS_UPDATES_DIR: /var/www/updates
+
+jobs:
+  deploy:
+    name: Deploy (VPS Linux)
+    if: ${{ startsWith(github.ref, 'refs/heads/') }}
+    runs-on: [ self-hosted, linux, vps ]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Sync workspace to APP_DIR
+        run: |
+          mkdir -p "$APP_DIR"
+          rsync -az --delete --exclude '.git' --exclude '.next' ./ "$APP_DIR"/
+
+      - name: Install and build (Next.js)
+        run: |
+          cd "$APP_DIR"
+          corepack enable || true
+          pnpm install --frozen-lockfile
+          pnpm prisma:generate
+          pnpm build
+
+      - name: Optional Swarm deploy (stack.yml)
+        if: ${{ hashFiles(format('{0}/stack.yml', env.APP_DIR)) != '' }}
+        run: |
+          cd "$APP_DIR"
+          docker stack deploy --with-registry-auth -c stack.yml sistema
+
+  desktop_release:
+    name: Desktop Release (Windows)
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: [ self-hosted, windows, desktop ]
+    defaults:
+      run:
+        working-directory: apps/desktop
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+
+      - name: Install deps (desktop)
+        run: pnpm install --frozen-lockfile
+
+      - name: Build with Tauri
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+        with:
+          projectPath: apps/desktop
+
+      - name: Upload latest.json + bundles to VPS
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          source: |
+            **/bundle/**/latest.json
+            **/bundle/**/*
+          target: ${{ env.VPS_UPDATES_DIR }}
+          overwrite: true
+