chore: migrate Docker builds to docker buildx bake

Replace 5 sequential build-push-action steps with a single docker/bake-action
call backed by docker-bake.hcl. BuildKit now builds all images in parallel:
backend/runner/pocketbase share one Go builder stage (compiled once), while
caddy and ui build concurrently alongside the Go targets.

Workflow YAML goes from ~130 lines of build steps to ~35. Adding a new image
now only requires a new target block in docker-bake.hcl.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-bake.hcl

@@ -0,0 +1,96 @@
+# docker-bake.hcl — defines all five production images.
+#
+# Used by CI (docker/bake-action) to build and push all images in one call,
+# with shared BuildKit cache and maximum parallelism:
+#   - backend, runner, pocketbase share the Go builder stage (built once)
+#   - caddy and ui build independently in parallel alongside the Go targets
+#
+# Local build (no push):
+#   docker buildx bake
+#
+# CI sets per-target tags and labels via --set overrides in docker/bake-action.
+
+# ── Variables injected by CI via --set ───────────────────────────────────────
+
+variable "DOCKER_USER" { default = "kalekber" }
+
+variable "VERSION"    { default = "dev" }
+variable "COMMIT"     { default = "unknown" }
+variable "BUILD_TIME" { default = "" }
+
+# ── Shared defaults ───────────────────────────────────────────────────────────
+
+# All targets inherit these.  CI overrides tags/labels per-target via --set.
+target "_defaults" {
+  pull   = true
+  output = ["type=image,push=false"]
+}
+
+# Registry cache shared across all targets in a run.
+target "_cache" {
+  cache-to = ["type=inline"]
+}
+
+# ── Go targets (share the backend/ build context + builder stage) ─────────────
+
+target "backend" {
+  inherits  = ["_defaults", "_cache"]
+  context   = "backend"
+  target    = "backend"
+  tags      = ["${DOCKER_USER}/libnovel-backend:latest"]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-backend:latest"]
+  args = {
+    VERSION = VERSION
+    COMMIT  = COMMIT
+  }
+}
+
+target "runner" {
+  inherits  = ["_defaults", "_cache"]
+  context   = "backend"
+  target    = "runner"
+  tags      = ["${DOCKER_USER}/libnovel-runner:latest"]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-runner:latest"]
+  args = {
+    VERSION = VERSION
+    COMMIT  = COMMIT
+  }
+}
+
+target "pocketbase" {
+  inherits  = ["_defaults", "_cache"]
+  context   = "backend"
+  target    = "pocketbase"
+  tags      = ["${DOCKER_USER}/libnovel-pocketbase:latest"]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-pocketbase:latest"]
+}
+
+# ── UI (SvelteKit — separate context) ────────────────────────────────────────
+
+target "ui" {
+  inherits  = ["_defaults", "_cache"]
+  context   = "ui"
+  tags      = ["${DOCKER_USER}/libnovel-ui:latest"]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-ui:latest"]
+  args = {
+    BUILD_VERSION = VERSION
+    BUILD_COMMIT  = COMMIT
+    BUILD_TIME    = BUILD_TIME
+    PREBUILT      = "1"
+  }
+}
+
+# ── Caddy (custom plugins — separate context) ─────────────────────────────────
+
+target "caddy" {
+  inherits  = ["_defaults", "_cache"]
+  context   = "caddy"
+  tags      = ["${DOCKER_USER}/libnovel-caddy:latest"]
+  cache-from = ["type=registry,ref=${DOCKER_USER}/libnovel-caddy:latest"]
+}
+
+# ── Default group: all five images ────────────────────────────────────────────
+
+group "default" {
+  targets = ["backend", "runner", "pocketbase", "ui", "caddy"]
+}