Base the release image on scratch

Build the backend as a fully static musl binary (rust:1-alpine +
x86_64-unknown-linux-musl) and run it in a scratch image with only the
binary and the compiled frontend: 32 MB instead of ~110 MB, no shell,
package manager or libc, running as the numeric user 10001:10001.

The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and
`tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and
Postgres validates against Mozilla's roots embedded in the binary by
webpki-roots, so no certificate files are needed; the OTLP client is built
without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http://
(documented). The Docker HEALTHCHECK is removed since scratch has no curl:
Kubernetes probes /api/health over HTTP and Compose gates on its dependency
checks. `strip = "symbols"` trims the release binary.

Validated with docker compose up --build: migrations, sessions, lobby
creation, the OIDC discovery redirect and the SPA all work, proving musl DNS
resolution for the postgres/redis/mockoauth service names.

server/.env.example

@@ -82,8 +82,9 @@ TURN_TIMEOUT_SECONDS=30
 # OpenTelemetry (compiled in by default). Off unless OTEL_ENABLED is
 # truthy; exports traces (HTTP/WebSocket) and process metrics, plus custom
 # tavolo.active_users / tavolo.ongoing_games gauges and logs over OTLP/HTTP.
-# The endpoint defaults to the standard OTEL_EXPORTER_OTLP_ENDPOINT
-# (localhost:4318) when unset.
+# The endpoint defaults to http://localhost:4318 when unset and must use
+# http:// (the OTLP client is built without a TLS backend; terminate TLS in
+# front of a remote collector).
 #OTEL_ENABLED=true
 #OTEL_SERVICE_NAME=tavolo
 #OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318