fix: harden voice rebuild workflow

.gitea/workflows/rebuild.yml

@@ -14,11 +14,44 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Build image
-        run: |
-          docker build -t hope-voice-api-voice .
+        run: docker build -t hope-voice-api-voice:latest .
 
       - name: Restart container
+        env:
+          AZURE_SPEECH_KEY: ${{ secrets.AZURE_SPEECH_KEY }}
         run: |
           docker stop voice 2>/dev/null || true
           docker rm voice 2>/dev/null || true
-          docker run -d             --name voice             --network host             --restart unless-stopped             -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs             -v /mnt/user/dev/hope-voice-api/skills:/skills             -v /mnt/user/dev/hope-voice-api/livekit.yaml:/etc/livekit.yaml:ro             -e LIVEKIT_URL=http://localhost:7880             -e AZURE_SPEECH_KEY=${{ secrets.AZURE_SPEECH_KEY }}             -e AZURE_SPEECH_REGION=eastus             -e AZURE_TTS_VOICE=en-US-Ava:DragonHDOmiLatestNeural             -e GEMMA_BASE_URL=http://192.168.86.2:8023/v1             -e GEMMA_MODEL=gemma-4-e4b             -e WEB_PORT=9178             hope-voice-api-voice
+          docker run -d \
+            --name voice \
+            --network host \
+            --restart unless-stopped \
+            -v /mnt/user/dev/hope-voice-api/certs:/etc/voice/certs \
+            -v /mnt/user/dev/hope-voice-api/skills:/skills \
+            -v /mnt/user/dev/hope-voice-api/livekit.yaml:/etc/livekit.yaml:ro \
+            -e LIVEKIT_URL=http://localhost:7880 \
+            -e LIVEKIT_API_KEY=devkey \
+            -e LIVEKIT_API_SECRET=hopevoice-devsecret-2026-lan-only \
+            -e AZURE_SPEECH_KEY="$AZURE_SPEECH_KEY" \
+            -e AZURE_SPEECH_REGION=eastus \
+            -e AZURE_TTS_VOICE=en-US-Ava:DragonHDOmniLatestNeural \
+            -e GEMMA_BASE_URL=http://192.168.86.2:8023/v1 \
+            -e GEMMA_MODEL=gemma-4-e4b \
+            -e GEMMA_API_KEY=not-needed \
+            -e WEB_MCP_ENABLED=true \
+            -e FIRECRAWL_BASE=http://192.168.86.2:3002 \
+            -e WEB_PORT=9178 \
+            -e VOICE_USERS_FILE=/etc/hope/users.json \
+            -e VOICE_DEFAULT_USER=shane \
+            hope-voice-api-voice:latest
+
+      - name: Verify deployment
+        run: |
+          for attempt in $(seq 1 12); do
+            if [ "$(docker inspect --format='{{.State.Health.Status}}' voice 2>/dev/null)" = "healthy" ]; then
+              exit 0
+            fi
+            sleep 5
+          done
+          docker logs voice
+          exit 1