Publish Docker Hub image on releases

[pessini]

Summary

• publish pessini/litedrop to Docker Hub from existing v* release tags
• add multi-arch Buildx publishing with semver, minor, latest, and sha tags
• update Docker/self-hosting docs so local users can pull and run the image without a domain
• switch the bundled Caddy compose deployment to pull the published image

Validation

• npm ci
• npm run typecheck
• npm run test
• npm run build
• npm run lint
• workflow YAML parse
• docker compose --env-file .env.example config
• container build -f apps/backend/Dockerfile -t litedrop:smoke .
• local smoke run on localhost:8080: /healthz returned OK and / returned dashboard HTML

Release note

With this workflow, Docker Hub publishing happens on new v* tag pushes after this is merged. Existing tags will not be republished retroactively unless we add a manual backfill workflow or recreate a tag, which I do not recommend.