chore(ci): add release gate workflow

[technowizard]

Summary

Adds a dedicated CI release gate and keeps Docker workflows focused on publishing images.

Changes

• Add .github/workflows/ci.yml
  • Runs on PRs to main, pushes to main, and manual dispatch.
  • Runs lint, typecheck, web tests, and build.
  • Runs server tests against a disposable Postgres service.
• Update Docker publish workflows
  • Remove PR triggers from image publish workflows.
  • Keep publish workflows for main, version tags, and manual dispatch.
  • Simplify GHCR login/build push logic now that these workflows are publish-only.

Why

The repo had Docker publish workflows but no dedicated CI quality gate. This separates responsibilities:

• CI validates changes before merge/release.
• Docker workflows publish artifacts after merge/tag/manual dispatch.

Notes

Server CI uses a disposable postgres:16 service and the existing test migration setup before running pnpm --filter server test.