ci: build images on every change, add install script

- docker job: buildx + GHA cache, GHCR push on main/tags via
  metadata-action tags, Trivy scan (report-only)
- fix: tag pushes now trigger the workflow so releases publish images
- root compose: parameterized host ports, backend healthcheck,
  frontend waits for healthy backend
- install.sh: generates .env secrets, builds, boots, waits for health
- README: easy-install section, port remap docs, CI badge

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker-compose.yml

@@ -1,3 +1,5 @@
+name: containr
+
 services:
   postgres:
     image: postgres:15-alpine
@@ -6,7 +8,7 @@ services:
       POSTGRES_USER: ${POSTGRES_USER:-containr_user}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dev_password_123}
     ports:
-      - "5432:5432"
+      - "${POSTGRES_PORT:-5432}:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -20,7 +22,7 @@ services:
     image: redis:7-alpine
     command: redis-server --requirepass ${REDIS_PASSWORD:-dev_redis_123}
     ports:
-      - "6379:6379"
+      - "${REDIS_PORT:-6379}:6379"
     volumes:
       - redis_data:/data
     healthcheck:
@@ -35,7 +37,7 @@ services:
       context: ./app/backend
       dockerfile: Dockerfile
     ports:
-      - "8082:8080"
+      - "${API_PORT:-8082}:8080"
     environment:
       DATABASE_URL: postgres://${POSTGRES_USER:-containr_user}:${POSTGRES_PASSWORD:-dev_password_123}@postgres:5432/${POSTGRES_DB:-containr}?sslmode=disable
       REDIS_URL: redis://:${REDIS_PASSWORD:-dev_redis_123}@redis:6379/0
@@ -84,6 +86,12 @@ services:
       redis:
         condition: service_healthy
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8080/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
 
   frontend:
     build:
@@ -93,10 +101,10 @@ services:
         VITE_API_URL: ${VITE_API_URL:-http://localhost:8082}
         VITE_AUTH_URL: ${VITE_AUTH_URL:-http://localhost:8082/api/auth}
     ports:
-      - "3000:80"
+      - "${HTTP_PORT:-3000}:80"
     depends_on:
       backend:
-        condition: service_started
+        condition: service_healthy
     restart: unless-stopped
 
 volumes: