feat: self-hosted Docker image with Gitea Actions and Unraid docs

- Dockerfile: replace s6overlay with multi-stage build (golang:1.22-alpine
  builder + alpine:3.19 runtime), compiles from source, no goreleaser needed
- docker/entrypoint.sh: PUID/PGID support via su-exec
- .gitea/workflows/docker.yml: auto-build and push to Gitea container
  registry on every master commit (linux/amd64 + linux/arm64)
- README: add tmdb api_key docs, update Docker section to point to
  forge.dilain.com registry, add Unraid setup section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/Dockerfile

@@ -1,21 +1,31 @@
-FROM sc4h/alpine-s6overlay:v2-3.15
+# Build stage
+FROM golang:1.22-alpine AS builder
 
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT
+WORKDIR /build
+COPY . .
+
+RUN CGO_ENABLED=0 go build \
+    -ldflags="-s -w" \
+    -trimpath \
+    -o nabarr \
+    ./cmd/nabarr
+
+# Runtime stage
+FROM alpine:3.19
+
+RUN apk add --no-cache ca-certificates tzdata su-exec
+
+COPY --from=builder /build/nabarr /app/nabarr
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 ENV \
-  PATH="/app/nabarr:${PATH}" \
   APP_CONFIG="/config/config.yml" \
   APP_CACHE="/config/cache" \
   APP_LOG="/config/activity.log" \
   APP_VERBOSITY="0"
 
-# Binary
-COPY ["dist/nabarr_${TARGETOS}_${TARGETARCH}${TARGETVARIANT:+_7}/nabarr", "/app/nabarr/nabarr"]
-
-# Add root files
-COPY ["docker/run", "/etc/services.d/nabarr/run"]
-
-# Volume
 VOLUME ["/config"]
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["run"]

docker/entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+PUID=${PUID:-1000}
+PGID=${PGID:-1000}
+
+if [ "$(id -u)" = "0" ]; then
+    addgroup -g "$PGID" nabarr 2>/dev/null || true
+    adduser -u "$PUID" -G nabarr -s /bin/sh -D nabarr 2>/dev/null || true
+    mkdir -p /config
+    chown -R nabarr:nabarr /config
+    exec su-exec nabarr /app/nabarr "$@"
+else
+    exec /app/nabarr "$@"
+fi