Base the release image on scratch

Build the backend as a fully static musl binary (rust:1-alpine +
x86_64-unknown-linux-musl) and run it in a scratch image with only the
binary and the compiled frontend: 32 MB instead of ~110 MB, no shell,
package manager or libc, running as the numeric user 10001:10001.

The binary moves to /usr/local/bin/tavolo so `tavolo migrate` and
`tavolo serve` resolve on PATH in compose and Kubernetes. TLS for OIDC and
Postgres validates against Mozilla's roots embedded in the binary by
webpki-roots, so no certificate files are needed; the OTLP client is built
without a TLS backend, so OTEL_EXPORTER_OTLP_ENDPOINT must be http://
(documented). The Docker HEALTHCHECK is removed since scratch has no curl:
Kubernetes probes /api/health over HTTP and Compose gates on its dependency
checks. `strip = "symbols"` trims the release binary.

Validated with docker compose up --build: migrations, sessions, lobby
creation, the OIDC discovery redirect and the SPA all work, proving musl DNS
resolution for the postgres/redis/mockoauth service names.

server/Cargo.toml

@@ -43,3 +43,4 @@ uuid = { version = "1", features = ["v4", "serde"] }
 [profile.release]
 lto = "thin"
 codegen-units = 1
+strip = "symbols"