fix(editor): bundle Monaco locally to fix stuck Loading state and CSP block

- Add monaco-editor to frontend deps and configure @monaco-editor/react
  to use the local bundle via loader.config({ monaco }) instead of
  fetching from cdn.jsdelivr.net (blocked by CSP scriptSrc: self)
- Wire editorWorker via Vite ?worker syntax — blob: URLs already
  permitted by existing workerSrc CSP directive, no CSP changes needed
- fix(ci): use DOCS_REPO_TOKEN in release-please so tag creation
  cascades to docker-publish.yml (GITHUB_TOKEN cannot trigger workflows)
- fix(ci): auto-merge screenshots PR via gh pr merge --auto --squash

.github/workflows/ci.yml

@@ -227,6 +227,7 @@ jobs:
           E2E_PASSWORD: password123
 
       - name: Open / update screenshots PR
+        id: create-pr
         uses: peter-evans/create-pull-request@v6
         with:
           token: ${{ secrets.DOCS_REPO_TOKEN }}
@@ -237,6 +238,15 @@ jobs:
           add-paths: docs/images/
           delete-branch: true
 
+      - name: Auto-merge screenshots PR
+        if: steps.create-pr.outputs.pull-request-number != ''
+        env:
+          GH_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
+        run: |
+          gh pr merge ${{ steps.create-pr.outputs.pull-request-number }} \
+            --auto --squash \
+            --repo ${{ github.repository }}
+
   sync-docs:
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref == 'refs/heads/develop'

.github/workflows/release-please.yml

@@ -15,6 +15,9 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # GITHUB_TOKEN cannot trigger other workflows (GitHub security restriction).
+          # Using DOCS_REPO_TOKEN (PAT) ensures the tag push from release-please
+          # cascades to docker-publish.yml and publishes to Docker Hub.
+          token: ${{ secrets.DOCS_REPO_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json