feat(docker): multi-arch builds, healthcheck, dependency caching

[allamiro]

Fixes #226, fixes #289, fixes #290.

Changes

Multi-arch / cross-compilation (#226, #289)

• Removed the hardcoded RUSTFLAGS="-Ctarget-cpu=sandybridge ..." from the Dockerfile and both workflows. The flags are x86-only (breaking arm64 builds entirely) and redundant: the aes crate detects AES-NI at runtime, so performance on amd64 is unaffected.
• container-image.yml now builds and pushes linux/amd64,linux/arm64 via setup-qemu/setup-buildx.
• Cross-compilation via tonistiigi/xx: the Rust build stage now runs on the native host platform (--platform=$BUILDPLATFORM) and cross-compiles to the target instead of emulating it under QEMU — roughly 10× faster arm64 builds in CI.
• Separate frontend stage: Node.js frontend build runs on the native host platform too (also avoids QEMU for npm).
• GitHub Actions layer cache (cache-from/cache-to: type=gha): successive CI runs reuse unchanged layers, dramatically reducing build times after the first run.

Healthcheck (#290)

• New unauthenticated GET /health endpoint.
• The binary gets a --health-check flag that probes /health over TCP (127.0.0.1 and ::1) — necessary because the scratch image has no shell or curl — wired up as the Dockerfile HEALTHCHECK.

Dockerfile quality (#290)

• Dependencies build in their own layer (stub main.rs trick), so source-only changes no longer recompile the whole dependency tree.
• ENV RUST_BACKTRACE=1; stray semicolon removed (it was part of the value).

Validation

• Full image built natively on arm64 (previously impossible) — docker image inspect: arch=arm64
• Container runs from the built image; docker inspect: health=healthy; /health returns {"status":"ok"}, index serves HTTP 200
• cargo test: 9/9 pass