ci: auto build multi-arch image to GHCR with cleanup

[webees]

What

Adds .github/workflows/docker.yml and optimizes the existing Dockerfile so every code change produces a ready-to-pull container image in GHCR.

Changes

• Multi-arch build without QEMU: linux/amd64 builds on ubuntu-latest, linux/arm64 builds on the native ubuntu-24.04-arm runner; per-arch digests are merged into a single manifest list afterwards.
• Triggers: push to main, v* tags, and manual dispatch. Markdown/docs-only changes are skipped. PRs build the image without pushing (no registry credentials used).
• Tags: latest on the default branch, plus branch, short SHA, and semver tags on v* releases.
• Speed: cached npm/go dependency layers, BuildKit cache mounts, and per-arch GHA cache scopes. Cold build is roughly 2.5 min total.
• Dockerfile fix: frontend assets are arch-independent, so they are built on $BUILDPLATFORM; this avoids vite/rollup native binaries crashing under arm64 emulation (qemu: uncaught target signal 4, exit 132). Also switched to npm ci for reproducible installs.
• Retention: each run trims old GHCR package versions (actions/delete-package-versions, untagged only) and old Actions runs (Mattraks/delete-workflow-runs), keeping the latest entries. Both actions are pinned by commit SHA.

Side effects worth a look before merging

• On merge, pushes to main will publish ghcr.io/openprx/fenfa automatically, including a latest tag.
• The retention step deletes older untagged package versions and older workflow runs in this repository. If you would rather keep full history, drop the two cleanup steps at the end of the merge job.

Verification

• actionlint .github/workflows/docker.yml passes (exit 0).
• Verified end-to-end in a fork: build(amd64), build(arm64) and merge all succeed; the merged manifest resolves both platforms, and the cleanup steps report successful deletions while skipping the in-progress run.