ci: publish backend image to GHCR

[znnnnnnn-wil]

• 在 main CI 的 backend、migrations、frontend 三个 Job 全部通过后构建 backend Docker image
• 发布镜像到 GHCR
• 同时生成 latest 和 commit SHA 两个 tag
• pull_request 阶段不会发布镜像
• 没有增加自动生产部署

[fennoai]

Reviewed the added GHCR publication job and its integration with the existing CI workflow. The job is limited to pushes on main, waits for backend, migrations, and frontend to succeed, uses job-scoped packages: write permission for GITHUB_TOKEN, and publishes the backend Docker context with both latest and commit-SHA tags.

Validation: the fixed SHA diff was inspected; the backend Dockerfile and .dockerignore match context: ./backend; the current PR run has backend and migration jobs passing while the frontend job remains in progress. I found no actionable correctness or regression issue in the changed lines.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!