fix(ci): update Dockerfiles and workflow to include new Cloudinary environment variable

- Added NEXT_PUBLIC_CLOUDINARY_CLOUD_NAME to both admin and storefront Dockerfiles to ensure it is available during the build process.
- Updated deploy-staging.yml to pass the new Cloudinary variable as a build argument.
- Clarified comments regarding the handling of NEXT_PUBLIC_* variables and Gitea secret prefixes.

This change enhances the build configuration for both applications, ensuring all necessary environment variables are correctly passed during the Docker build process.

apps/storefront/Dockerfile

@@ -34,8 +34,9 @@ COPY --from=deps /app/node_modules ./node_modules
 COPY full/ .
 
 # NEXT_PUBLIC_* vars are baked into the client bundle at build time by Next.js.
-# They must be present here (not just at runtime) or SSG/prerender fails with
-# "Missing publishableKey". Pass via --build-arg in CI.
+# They must be present here (not just at runtime) or SSG/prerender fails.
+# Passed via --build-arg in CI. Note: Gitea secrets use a STAGING_/PROD_ prefix
+# which is stripped by the workflow before being forwarded here as build args.
 ARG NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
 ARG NEXT_PUBLIC_CONVEX_URL
 ENV NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=$NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY \