feat: publish api, app and agent Docker images from release

[AndersSpringborg]

Summary by cubic

Adds Docker support so pushes to release publish api, app, and agent images to GitHub Container Registry, with documentation and a list of known risks.

Publishing

• New root Dockerfile with three targets and a workflow that tags images latest, the root package.json version, and sha-<commit>.
• The api container runs prisma migrate deploy before listening, so start it before the app and agent.
• The app bakes in NEXT_PUBLIC_API_URL at build time; the workflow reads it from repository variables and defaults to http://localhost:3001.

Known risks

• The agent trusts Host: localhost for local dev, so its port must never be exposed publicly.
• Release-created commits use GITHUB_TOKEN, which may not trigger the Docker workflow; use AUTOMATION_TOKEN or run it manually.
• Only linux/amd64 images are built, and the app image is about 4.7 GB unpacked.

^{Written for commit 09f9399. Summary will update on new commits.}

[vercel]

@AndersSpringborg is attempting to deploy a commit to the Comp AI - PoC Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Retargeted this onto main.

release is the default branch so that a plain clone runs the last tagged release, but nothing merges into it — it is fast-forwarded onto the tag by the Release workflow and that is all. Changes go to main, and reach release when a release is cut.

Nothing is wrong with your branch. If the diff now shows commits that are already on main, rebase and force-push:

git fetch origin main
git rebase origin/main
git push --force-with-lease