ci: publish the container image to the Gitea registry

Adopts the release scheme from legacy-email-proxy so both repositories behave
the same way: the version is derived from conventional commits since the last
v* tag, the image is pushed under the full version, the truncated major.minor
and major forms, and latest, and non-release builds are published as
sha-<short>. Multi-arch (amd64 for the NAS, arm64 so the same image runs on a
Pi). Authentication uses the PACKAGES_SECRET repository secret.

The release step also writes the computed version into pyproject.toml and
commits it as chore(release) before tagging, so the packaging metadata cannot
drift behind the release. It skips the commit when the file already carries
that version, which would otherwise fail the job after the image had been
pushed.

compose.yaml and the README now reference the published image instead of
instructing the NAS to build one locally.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

compose.yaml

@@ -1,15 +1,11 @@
 # TrueNAS Scale "Custom App" definition.
 #
-# Build the image on the NAS first (there is no published image yet):
-#   git clone https://code.emmathe.dev/lyrathorpe/music-mirror
-#   cd music-mirror && docker build -t music-mirror:latest .
-#
 # Adjust the two host paths and the user to match your pool. The source is
 # mounted read-only on purpose: nothing here should ever be able to write to
 # the lossless library.
 services:
   music-mirror:
-    image: music-mirror:latest
+    image: code.emmathe.dev/lyrathorpe/music-mirror:latest
     container_name: music-mirror
     restart: unless-stopped
     # The dataset owner, so the mirror is not written as root. `id apps` or the