CI: GitHub Actions build and release workflows

- build.yml: runs on push to main, builds Docker image + packs s9pk,
  uploads artifact
- release.yml: runs on version tags (v*.*), builds and creates GitHub
  release with s9pk attached
- Dockerfile: build context is repo root (docker build -f deploy/Dockerfile .)
- Manifest: switched to dockerTag (pre-built image pattern)
- Makefile + s9pk.mk: local build support

deploy/Dockerfile

@@ -1,18 +1,17 @@
+# Build context is the repo root (docker build -f deploy/Dockerfile .)
+
 # --- Frontend build stage ---
 FROM node:20-slim AS frontend-build
 
-WORKDIR /build/frontend
+WORKDIR /build
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci --include=dev
 COPY frontend/ ./
 RUN npx vite build
 
-# --- Backend stage ---
+# --- Backend + runtime stage ---
 FROM python:3.11-slim
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    && rm -rf /var/lib/apt/lists/*
-
 WORKDIR /app
 
 # Install Python deps
@@ -23,7 +22,7 @@ COPY backend/alembic.ini ./
 RUN pip install --no-cache-dir .
 
 # Copy built frontend
-COPY --from=frontend-build /build/frontend/dist ./static/
+COPY --from=frontend-build /build/dist ./static/
 
 # Startup script
 COPY deploy/start.sh ./start.sh
@@ -33,7 +32,7 @@ RUN chmod +x ./start.sh
 RUN mkdir -p /data
 
 ENV TEN31_DB_PATH=/data/portal.db
-ENV TEN31_SESSION_SECRET=change-me
+ENV TEN31_SESSION_SECRET=***
 
 EXPOSE 8000