ci: image caching, Trivy scans, edge publishing, standalone installer

- docker-build job is now a per-app matrix with GHA layer cache, a
  container contents smoke check, and a non-blocking Trivy scan.
- New docker-publish job pushes edge + sha tags to GHCR on master.
- Fixed release.yml tagging ghcr.io/<Owner>/... with a mixed-case
  owner — GHCR requires lowercase, so tagged releases would have
  failed at push time.
- compose files: image: keys name local builds after the GHCR repos.
- install.sh: curl|bash installer — fetches compose files, generates
  secrets, pulls prebuilt images (docker pull + up --no-build, since
  compose pull skips buildable services), falls back to a source
  tarball build when packages aren't public.
- README: install section covering the one-liner, clone, and prebuilt
  paths plus common compose commands.

Verified locally: all three images build, full dev-overlay stack
passes scripts/smoke-e2e.sh, and install.sh produces a healthy
stack in a standalone directory.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker-compose.yml

@@ -29,6 +29,7 @@ services:
     restart: unless-stopped
 
   backend:
+    image: ghcr.io/dvorinka/primora-backend:latest
     build:
       context: .
       dockerfile: apps/backend/Dockerfile
@@ -56,6 +57,7 @@ services:
     restart: unless-stopped
 
   auth:
+    image: ghcr.io/dvorinka/primora-auth:latest
     build:
       context: .
       dockerfile: apps/auth/Dockerfile
@@ -81,6 +83,7 @@ services:
     restart: unless-stopped
 
   frontend:
+    image: ghcr.io/dvorinka/primora-frontend:latest
     build:
       context: .
       dockerfile: apps/frontend/Dockerfile