feat(server): multi-stage Dockerfile that builds Go from source

[Flo5k5]

The previous Dockerfile assumed that the Go binary was already built on
the host and copied into the build context before running docker build.
That required a separate prep step, only worked when the host arch
matched the target, and made the docker.sh pre-build shell mandatory.

The multi-stage version compiles the server inside the image using
golang:1.24-alpine, so a plain "docker build" works out of the box on
any platform supported by the builder (amd64, arm64...). This is what
lets a homelab node cross-build and run the server natively on
Raspberry Pi without juggling pre-compiled binaries.

Also:

• build with -trimpath and stripped symbols for smaller images
• install ca-certificates and tzdata in the runtime layer so TLS and
  timezone-aware logging work correctly
• EXPOSE 12800 so compose tools and scanners see the port
• run the binary via absolute path to remove the implicit ./ in CMD

[Flo5k5]

I've enriched this PR to cover the backend v2 requirements (merged via commit d7ae856). The original Dockerfile (just multi-stage Go build) was no longer sufficient — backend v2 introduces hard runtime requirements that crash the container at boot.

4 additional fixes layered on top of the original multi-stage Dockerfile (804760e, 1bb7e05, d321b55, 2f90ab1):

1. Go 1.26 — go.mod bumped to 1.26.3 by backend v2, but the Dockerfile pinned golang:1.24-alpine. go mod download was failing with GOTOOLCHAIN=local mismatch.
2. go mod tidy before build — backend v2 added imports (gerror, guid, ...) without regenerating go.sum. Build failed with missing go.sum entry.
3. Empty web/management dir — cmd.go:84 calls s.SetServerRoot("web/management") which FATAs if the dir is missing. The admin frontend UI is built separately (npm) and not bundled in the image. Creating an empty dir lets the API boot.
4. RSA key provisioning via entrypoint.sh — utility/rsa.go:31 panics at init() if any of rsa.{server,client}.{public,private} is empty in config.yaml. Rather than asking operators to leak PEM material into a committed config, the entrypoint generates two 2048-bit RSA pairs at first boot and rewrites the rsa: section as YAML block scalars. Idempotent: skips if operator pre-filled the keys, persists to /app/rsa-keys (bind-mount-friendly).

Bonus context I discovered along the way (heads-up, separate from this PR): device.NewV1() and stackchandevice.NewV2() register duplicate routes on /stackChan/device/user, FATAs at boot. Workaround is server.routeOverWrite: true in the config — might be worth a fix on your side too.

Happy to split into separate PRs if that helps review. The original multi-stage goal (build Go from source instead of COPY pre-compiled binary) is preserved as the bottom commit.