build: containerize the API and publish images to GHCR

Multi-stage Dockerfile (python:3.11-slim, non-root, /health healthcheck)
with an entrypoint that applies alembic migrations before uvicorn, a
compose file pairing the API with Postgres 16, and a CI workflow that
builds multi-arch images and pushes branch/semver/sha/latest tags to
ghcr.io. PR builds compile the image without pushing.

docker-entrypoint.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Apply migrations before starting the API. Set RUN_MIGRATIONS=false when running
+# multiple replicas and migrating out-of-band (`alembic upgrade head`) instead.
+set -e
+
+if [ "${RUN_MIGRATIONS:-true}" = "true" ]; then
+    alembic upgrade head
+fi
+
+exec "$@"