docker: image for the Oracle server, Trivy gate, and a release workflow

Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

next.config.mjs

@@ -1,5 +1,8 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+	// A imagem Docker liga isto (NEXT_OUTPUT=standalone) para empacotar só o que
+	// o servidor usa. Fora dela o build continua igual: `next start`/pm2.
+	output: process.env.NEXT_OUTPUT === "standalone" ? "standalone" : undefined,
 	experimental: {
 		optimizePackageImports: [
 			"lucide-react",