security: hardened OCI

[mroxso]

This pull request updates the Dockerfile to use newer base images and streamlines the final runtime environment by switching to a minimal scratch image. These changes reduce the image size and remove unnecessary dependencies and user setup steps.

Base image updates:

• Changed the builder stage to use golang:1.25.5-alpine instead of golang:1.24.1-alpine, ensuring the build uses the latest Go version.

Runtime image simplification:

• Replaced the final runtime image from alpine:3.20 to scratch, removing all package installations and custom user/group creation for a more minimal container.
• Removed creation and ownership setup of the /app/badger data directory, as well as the switch to a non-root user, since scratch does not support these operations.