build: containerize the API and publish images to GHCR

Multi-stage Dockerfile (python:3.11-slim, non-root, /health healthcheck)
with an entrypoint that applies alembic migrations before uvicorn, a
compose file pairing the API with Postgres 16, and a CI workflow that
builds multi-arch images and pushes branch/semver/sha/latest tags to
ghcr.io. PR builds compile the image without pushing.

.dockerignore

@@ -0,0 +1,20 @@
+# Keep the build context to what the image actually needs: pyproject.toml,
+# README.md (referenced by pyproject), src/, alembic.ini, docker-entrypoint.sh.
+.git
+.github
+.venv
+.omc
+.pytest_cache
+.ruff_cache
+**/__pycache__
+*.py[cod]
+tests
+docs
+.env
+.env.*
+!.env.example
+*.db
+Dockerfile
+docker-compose.yml
+.dockerignore
+.mise.toml