Harden Docker image and deployment configuration

[jjoonleo]

Summary

• Build the backend as a multi-stage, non-root Docker image with actuator readiness health checks.
• Switch production Compose and deploy workflow to versioned GHCR images with runtime env/secret injection.
• Load Firebase and Apple credentials from environment-backed secrets instead of source resource mounts.
• Document required secrets, deployment verification, and rollback steps.

Verification

• ./gradlew bootJar --no-daemon
• IMAGE_TAG=test docker compose config
• git diff --check

Closes #280