Fix the CD wine build and add per-part toggles

The Windows NSIS step failed under wine for two reasons: no X display
(nodrv_CreateWindow) and missing 32-bit libraries (failed to load
syswow64\ntdll.dll). The job now installs xvfb + wine32:i386 and runs the
desktop build under xvfb-run, with Gecko/Mono lookups disabled.

Also add `images` and `desktop` dispatch inputs so either half of the CD
can be skipped (e.g. desktop-only or images-only releases).

.gitea/workflows/cd.yml

@@ -1,6 +1,7 @@
 # J621 CD — manual release workflow (Actions tab -> "Run workflow").
 #
-# One dispatch does everything:
+# One dispatch does everything; each half can be skipped with the `images`
+# and `desktop` inputs:
 #   * builds and pushes the backend + frontend images (multi-arch, :latest
 #     and :<short-sha>, GIT_HASH baked in for the version pill),
 #   * builds the desktop packages and attaches them (plus the update
@@ -21,6 +22,14 @@ name: CD
 on:
   workflow_dispatch:
     inputs:
+      images:
+        description: Build and push the Docker images
+        required: false
+        default: "true"
+      desktop:
+        description: Build the desktop release
+        required: false
+        default: "true"
       platforms:
         description: Image platforms (comma separated)
         required: false
@@ -37,6 +46,7 @@ concurrency:
 jobs:
   images:
     name: Build & push images
+    if: ${{ inputs.images != 'false' }}
     runs-on: ubuntu-latest
     # The Gitea container registry does not accept the automatic job token
     # (go-gitea/gitea#23642 is still open), so the push uses a repo PAT with
@@ -73,6 +83,7 @@ jobs:
 
   desktop:
     name: Desktop release
+    if: ${{ inputs.desktop != 'false' }}
     runs-on: ubuntu-latest
     # Creating the release and uploading its assets uses the automatic job
     # token, so it needs write access to the repository's releases.
@@ -90,7 +101,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends fakeroot libarchive-tools
           if [ "${{ inputs.windows }}" = "true" ]; then
-            sudo apt-get install -y --no-install-recommends wine
+            # electron-builder runs the 32-bit NSIS installer under wine to
+            # build the uninstaller: that needs a virtual display (Xvfb) and
+            # 32-bit wine libraries.
+            sudo dpkg --add-architecture i386
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends xvfb wine wine32:i386
           fi
 
       - name: Install frontend + desktop dependencies
@@ -99,9 +115,12 @@ jobs:
           npm --prefix desktop ci --no-audit --no-fund
 
       - name: Build desktop packages
+        env:
+          # Keep wine from trying to fetch Gecko/Mono on first run.
+          WINEDLLOVERRIDES: mscoree,mshtml=
         run: |
           if [ "${{ inputs.windows }}" = "true" ]; then
-            ./deploy/build_desktop.sh --all
+            xvfb-run -a ./deploy/build_desktop.sh --all
           else
             ./deploy/build_desktop.sh --linux
           fi