Add a Docker workflow that publishes multi-arch images

Pushes :edge for main and :x.y.z, :x.y and :latest for release tags,
optionally mirrored to another registry. The release workflow no longer
builds the image itself, so a tag does not publish it twice. The README
covers running the image anywhere and the settings the workflows read.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -48,24 +48,52 @@ All except `/` need `Authorization: Bearer <token>`.
 
 ## Docker
 
+The image is `git.veillax.com/veillax/spinner` for linux/amd64 and linux/arm64. It runs as a non-root user, keeps its config in the `/data` volume, and writes a starter `spinner.json` there on first start. The admin page on port 8080 is the quickest way to add servers; keep it private or behind HTTPS.
+
+| Tag | Meaning |
+| --- | --- |
+| `latest` | The newest release |
+| `1.2.3`, `1.2` | An exact release, or the newest patch of a minor version |
+| `edge` | The latest commit on `main` |
+| `sha-<commit>` | One specific commit |
+
+Run it anywhere Docker runs:
+
 ```
-cp .env.example .env        # set SPINNER_ADMIN_TOKEN
-docker compose -f deploy/docker-compose.yml up -d
+docker run -d --name spinner --restart unless-stopped \
+  -p 25565:25565 -p 127.0.0.1:8080:8080 \
+  -e SPINNER_ADMIN_TOKEN=change-me \
+  -v spinner-data:/data \
+  git.veillax.com/veillax/spinner:latest
 ```
 
-The image is `git.veillax.com/veillax/spinner` (linux/amd64 and linux/arm64). It keeps its config in the `/data` volume and writes a starter `spinner.json` there on first start, so the admin page on port 8080 is the quickest way to add servers. Keep that port private or behind HTTPS.
+Or with Compose: `cp .env.example .env`, set `SPINNER_ADMIN_TOKEN`, then `docker compose -f deploy/docker-compose.yml up -d`. Backends on the Docker host are reachable at `host.docker.internal` (add `--add-host host.docker.internal:host-gateway` on Linux), or put Spinner and the Minecraft containers on one Docker network and use their container names.
+
+If the registry is private, run `docker login git.veillax.com` first.
 
 ## Releases
 
-Push a tag to build archives, publish a release and push the image:
+Push a tag to publish a release and its image:
 
 ```
 git tag -a v0.1.0 -m "spinner v0.1.0" && git push origin v0.1.0
 ```
 
-`.gitea/workflows/release.yml` runs `deploy/build.sh`, uploads the archives with `deploy/publish-release.sh`, then builds and pushes the image. Set the repository variable `PUBLISH_DOCKER` to `false` to skip the image. If the job token cannot write releases or packages, add the secrets `RELEASE_TOKEN` and `REGISTRY_TOKEN` (and the variable `REGISTRY_USER`).
+Two workflows run on the tag:
 
-To build by hand: `sh deploy/build.sh` puts binaries and archives in `dist/`, then `docker buildx build .` packages the linux binary.
+* `.gitea/workflows/release.yml` builds archives with `deploy/build.sh` and uploads them with `deploy/publish-release.sh`.
+* `.gitea/workflows/docker.yml` tests, builds both Linux binaries and pushes the image. It also pushes `edge` on every push to `main`, and can be run by hand from the Actions tab.
+
+Settings, all optional:
+
+| Name | Kind | Use |
+| --- | --- | --- |
+| `REGISTRY_TOKEN`, `REGISTRY_USER` | secret, variable | Token with package write permission, if the job token cannot push |
+| `RELEASE_TOKEN` | secret | Token that can write releases, if the job token cannot |
+| `MIRROR_IMAGE`, `MIRROR_USER`, `MIRROR_TOKEN` | variable, variable, secret | Also push to another registry, for example `ghcr.io/you/spinner` or `docker.io/you/spinner` |
+| `PUBLISH_DOCKER` | variable | Set to `false` to skip the image |
+
+The runner needs Docker with buildx. To build by hand: `sh deploy/build.sh` puts binaries and archives in `dist/`, then `docker buildx build .` packages the linux binary for your platform.
 
 ## Not in v1