Fix Docker publish: pass metadata tags to manifest merge

[Lucifix]

What does this change?

Fixes the failing Merge manifests & tag job in the Docker publish workflow. That job failed on the run for #8's merge: https://github.com/Lucifix/model-workshop-manager/actions/runs/35005981097

The step read the tags from DOCKER_METADATA_OUTPUT_JSON with the jq path .target."docker-metadata-action".tags. That path belongs to the bake-file format, and this variable doesn't use it, so jq returned null. With no tags, imagetools create refused to push:

jq: error (at <stdin>:1): Cannot iterate over null (null)
ERROR: can't push with no tags specified, please set --tag or --dry-run

So main never got latest or sha-* tags on GHCR, only untagged per-arch digests. The Docker Hub mirror step comes after this one and never ran.

The step now:

• reads steps.meta.outputs.tags (newline-separated), the same source the Docker Hub mirror step already uses
• builds the imagetools create arguments as a bash array instead of relying on word splitting
• stops with a clear ::error:: if metadata-action produced no tags

Reviewer notes

• I checked the argument building locally with sample tags and digest files. The real check is the next run on main after merge.
• After the first successful run, the GHCR package has to be set to Public; new packages start out private.
• Docker Hub mirroring only runs if the DOCKERHUB_USERNAME / DOCKERHUB_TOKEN repo secrets are set.

Related issue

Follow-up to #8.

Checklist

• Ran npm run lint:fix and npm run fmt at the repo root (fmt:check passes)
• Added/updated backend tests for behavior changes (if applicable): n/a, workflow only
• npm run typecheck and npm run build pass: n/a, no app code changed
• Followed existing conventions (comments explain why not what)

Screenshots

n/a