ci: split dev image publishing by registry

.github/workflows/_docker-build-push.yml

@@ -2,11 +2,11 @@ name: Docker build & push (reusable)
 
 # Reusable workflow that builds the three image targets defined in
 # deploy/docker/Dockerfile (backend, worker, frontend) and optionally pushes
-# them to both ghcr.io and Docker Hub under the 3252a8/ namespace.
+# them to the selected registries under the 3252a8/ namespace.
 #
 # Called by:
 #   - docker-dev.yml      (tag_mode: dev,     push: true)  on pushes to dev
-#   - docker-release.yml  (tag_mode: release, push: true)  on pushes to main
+#   - docker-release.yml  (tag_mode: release, push: true)  on release tags
 #   - ci.yml              (tag_mode: dev,     push: false) on pull requests
 
 on:
@@ -20,6 +20,10 @@ on:
         description: "Tagging strategy: 'dev' or 'release'"
         type: string
         required: true
+      publish_dockerhub:
+        description: "Include Docker Hub tags and login when pushing"
+        type: boolean
+        default: true
 
 # No permissions block here on purpose: a reusable workflow cannot request more
 # than its caller grants, so the token scope is set by each caller
@@ -78,7 +82,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to Docker Hub
-        if: inputs.push
+        if: inputs.push && inputs.publish_dockerhub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -89,8 +93,8 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: |
-            3252a8/${{ matrix.image }}
-            ghcr.io/3252a8/${{ matrix.image }}
+            name=3252a8/${{ matrix.image }},enable=${{ inputs.publish_dockerhub }}
+            name=ghcr.io/3252a8/${{ matrix.image }},enable=true
           tags: |
             type=raw,value=dev,enable=${{ inputs.tag_mode == 'dev' }}
             type=raw,value=latest,enable=${{ inputs.tag_mode == 'release' }}