Publish multi-arch Docker image to GHCR and Docker Hub

[Lucifix]

What does this change?

Adds .github/workflows/docker-publish.yml. On every push to main, on v*.*.* tags and on manual runs, it runs typecheck and tests. Then it builds linux/amd64 and linux/arm64 on native runners, pushes them by digest and merges them into one multi-arch manifest on ghcr.io/lucifix/model-workshop-manager. If DOCKERHUB_USERNAME/DOCKERHUB_TOKEN secrets are set, that manifest is copied to Docker Hub without a second build.

• Tags: pushes to main get latest and sha-xxxxxxx. Release tags vX.Y.Z get X.Y.Z, X.Y and X, and never move latest.
• docker-compose.yml now pulls the published image (APP_IMAGE_TAG, defaults to latest), so a Portainer stack or a curl'd compose file works without cloning the repo.
• docker-compose.override.yml is picked up automatically in a repo clone and adds build:, so docker compose up -d --build still builds from source.
• Dockerfile now sets DATABASE_URL, DATA_DIR, UPLOAD_DIR and BACKUP_DIR to the mounted paths. The app's own defaults are relative paths, so a bare docker run would otherwise write data into the container instead of the volume.
• README: split into "pull the published image" (with a Portainer snippet) and "build from source". APP_IMAGE_TAG added to the env table.

Reviewer notes / known follow-ups

The pre-PR review found these; none are fixed in this PR:

• A new GHCR package starts out private. After the first publish it has to be set to Public, or pulls from the README fail.
• The README snippet's workshop-data volume has no name:, but docker-compose.yml pins one. Switching between the two gives you a different, empty volume.
• A manual run from a branch other than main produces no tags, so the merge step fails.
• In a clone, a local --build gets the same name as the published :latest, so a pull and a build overwrite each other.
• The Docker Hub image name uses DOCKERHUB_USERNAME as-is, so the secret must be lowercase.

Related issue

None.

Checklist

• Ran npm run lint:fix and npm run fmt at the repo root (fmt:check passes)
• Added/updated backend tests for behavior changes (if applicable): n/a, infra only
• npm run typecheck and npm run build pass: not run locally, no app code changed
• Followed existing conventions (comments explain why not what)

Screenshots

n/a