Add CI workflow for backend container build and push

[haljac]

Problem

The backend/ directory contains a PocketBase backend but has no CI/CD pipeline. Backend changes are not automatically built, tested, or deployed. There is no container image published for deployment.

Scope of Work

Create .github/workflows/backend.yml

Triggers:

• Push to main with changes in backend/**
• PRs to main with changes in backend/**
• Use paths filter to avoid running on frontend-only changes

Steps:

1. Checkout code
2. Set up Docker Buildx
3. Build multi-arch container image (linux/amd64, linux/arm64)
4. On main: push to container registry (GCR, GHCR, or artifact registry)
5. On PR: build only (no push), verify the image builds successfully

Authentication:

• Use OIDC with google-github-actions/auth for GCP, or docker/login-action for GHCR
• Store credentials as repository secrets

Tagging strategy:

• latest for main
• Git SHA for traceability
• Semantic version tags if releases are tagged

Acceptance Criteria

• .github/workflows/backend.yml exists and triggers only on backend/** changes
• Multi-arch container image builds successfully
• Image is pushed to a container registry on main branch pushes
• PR builds verify the image builds but don't push
• Registry authentication uses OIDC or secrets (no hardcoded credentials)
• Image tags include git SHA for traceability