Add production Docker image packaging and GHCR release workflows

[Copilot]

This adds a production container path for the Vite-built SPA without changing the existing release.yaml asset release flow. The repository can now build an nginx image locally, validate Docker packaging in CI, and publish multi-arch images to GHCR on v* tags.

• Production image packaging

  • Added docker/Dockerfile as a multi-stage build:
    • node:24.10.0-alpine + pnpm@10.33.0 to build dist
    • nginx:alpine runtime serving the built assets
  • Preserved the existing SPA fallback by reusing docker/nginx/default.conf
  • Added OCI metadata labels for revision, version, and source

  FROM node:24.10.0-alpine AS build
  WORKDIR /app
  RUN corepack enable && corepack prepare pnpm@10.33.0 --activate
  COPY package.json pnpm-lock.yaml ./
  RUN pnpm install --frozen-lockfile
  COPY . .
  RUN pnpm build
  
  FROM nginx:alpine
  COPY docker/nginx/default.conf /etc/nginx/conf.d/default.conf
  COPY --from=build /app/dist /usr/share/nginx/html

• Docker build inputs and local workflow

  • Added root .dockerignore to keep build context clean without excluding required app sources
  • Extended Makefile with:
    • docker-build
    • docker-run
    • docker-lint
    • docker-scan
    • ci-test-docker

• CI and release automation

  • Added .github/workflows/docker.yaml for Docker-focused CI on main, feature/**, and PRs to main
  • Added .github/workflows/ghcr-release.yaml for GHCR-only multi-arch publish on v* tags
  • Kept the existing dist asset release workflow unchanged and coexisting

• Compose integration

  • Updated docker/compose.yaml so web builds from:
    • context: ..
    • dockerfile: docker/Dockerfile

• Documentation

  • Added docker / ghcr badges to README.md
  • Documented local image build/run, compose usage, and GHCR release behavior

[ks6088ts]

fixes #22