feat(skel): multi-stage Dockerfile for minstrel runtime

Builder uses golang:1.23-bookworm (matches runner-base:go-ci).
Runtime is debian:bookworm-slim with ffmpeg (server spec §3) plus a
non-root minstrel user. Release workflow builds from this Dockerfile.

Dockerfile

@@ -0,0 +1,25 @@
+# syntax=docker/dockerfile:1.6
+
+FROM golang:1.23-bookworm AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ENV CGO_ENABLED=0
+RUN go build -trimpath -ldflags="-s -w" -o /out/minstrel ./cmd/minstrel
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --system --gid 1000 minstrel \
+    && useradd --system --uid 1000 --gid minstrel --shell /usr/sbin/nologin minstrel
+
+COPY --from=builder /out/minstrel /usr/local/bin/minstrel
+COPY config.example.yaml /etc/smartmusic/config.yaml
+
+USER minstrel
+EXPOSE 4533
+ENTRYPOINT ["/usr/local/bin/minstrel"]
+CMD ["--config", "/etc/smartmusic/config.yaml"]