A prebuilt image for amd64 and arm64, and the container no longer runs as root

Until now `docker compose up` built the image on the user's machine:
a compiler toolchain, every dev dependency, a few minutes of CPU — on a
Raspberry Pi considerably more. The compose files now pull
ghcr.io/tillheidrich/klarbild:1, built by .github/workflows/image.yml
for linux/amd64 and linux/arm64. `:1` follows every 1.x release, so an
update is `docker compose pull && docker compose up -d`. `build: .` is
one commented line away for anyone who prefers to build.

The Dockerfile has two stages now. The runtime stage carries the built
server, production dependencies and the migrations — no compiler, no
dev dependencies, no source tree. argon2 and sharp ship prebuilt
binaries for both architectures, so python/make/g++ are gone entirely.
It runs as the `node` user (uid 1000); a fresh named volume at /data
inherits that ownership.

Verified locally: image builds, boots against Postgres, applies all 17
migrations, prints the first-run password, passes its healthcheck,
accepts an upload as the unprivileged user and returns an A4 sheet that
measures 210.00 x 297.00 mm.

.dockerignore

@@ -5,3 +5,8 @@ dist
 *.log
 .env
 # Do NOT ignore migrations/ — they are read at runtime, on every boot.
+docs
+tests
+.github
+*.md
+!README.md