Enable auth-service/api-gateway on production, build their images in CI

.github/workflows/build-practice-images.yml

@@ -18,6 +18,8 @@ on:
     paths:
       - apps/ai-service/**
       - apps/web/**
+      - apps/auth-service/**
+      - apps/api-gateway/**
       - packages/**
       - ingestion/data/verified/drug_entities.json
       - .github/workflows/build-practice-images.yml
@@ -66,6 +68,33 @@ jobs:
           cache-from: type=gha,scope=practice-web
           cache-to: type=gha,mode=max,scope=practice-web
 
+      - name: Build and push auth-service
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/auth-service/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-auth-service:${{ github.sha }}
+          cache-from: type=gha,scope=practice-auth-service
+          cache-to: type=gha,mode=max,scope=practice-auth-service
+
+      - name: Build and push api-gateway
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/api-gateway/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-api-gateway:${{ github.sha }}
+          cache-from: type=gha,scope=practice-api-gateway
+          cache-to: type=gha,mode=max,scope=practice-api-gateway
+
+      # auth-service/api-gateway are NOT in sync_practice_argocd.py's IMAGES
+      # tuple yet — that script fails the whole run if a tag it expects to
+      # rewrite isn't already present inline on the Application, so extending
+      # it must wait until someone has added `authService.image` /
+      # `apiGateway.image` blocks to the live Application by hand (see
+      # infra/helm/medical-chatbot/values-production.yaml). Until then, these
+      # two images are pushed here but must be repointed manually.
       - name: Point the practice ArgoCD Application at the new images
         env:
           ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}