docker: image for the Oracle server, Trivy gate, and a release workflow

Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,19 @@
+# Fora do contexto de build: dependências locais, saídas, outro repositório (book) e estado de ferramentas.
+node_modules
+.next
+dist
+build
+out
+coverage
+book
+.git
+.gitea
+.github
+.claude
+.superset
+.wolf
+.env*
+*.log
+*.tsbuildinfo
+Dockerfile
+.dockerignore