ci: add Docker CD workflow to push images to GHCR

Multi-stage Dockerfile for smaller runtime image, CD workflow triggers
on main branch pushes and version tags, docker-compose defaults to the
prebuilt GHCR image.

Dockerfile

@@ -1,14 +1,29 @@
-FROM golang:1.25-alpine3.21
+# Build stage
+FROM golang:1.25-alpine3.21 AS builder
 
-ENV GO111MODULE=on
-
-WORKDIR /app/erupe
-
-COPY go.mod .
-COPY go.sum .
+WORKDIR /build
 
+COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
+RUN CGO_ENABLED=0 go build -o erupe-ce .
 
-CMD [ "go", "run", "." ]
+# Runtime stage
+FROM alpine:3.21
+
+RUN adduser -D -h /app erupe
+WORKDIR /app
+
+COPY --from=builder /build/erupe-ce .
+COPY --from=builder /build/www/ ./www/
+COPY --from=builder /build/schemas/ ./schemas/
+# bundled-schema/ is optional demo data, copy if present
+RUN mkdir -p bundled-schema
+
+# bin/ and savedata/ are mounted at runtime via docker-compose
+# config.json is also mounted at runtime
+
+USER erupe
+
+ENTRYPOINT ["./erupe-ce"]