chore(spa-server): add Makefile and OCI image labels to Dockerfile

Makefile:
- dry-run target (default) shows registry, branch, SHA, version, all computed
  image tags, and build args — no side effects
- build/push/release targets wire docker build and docker push
- Branch-aware tag strategy:
    main        → <version> + latest
    develop     → <version>-dev-<short-sha>
    release/*   → <version>-qa-<short-sha>
- Version resolved from the highest semver tag at HEAD; falls back to the most
  recent reachable tag via git describe
- BASE_DIGEST resolved at build time from the local Docker daemon; dry-run
  prints a hint when the base image is not yet pulled
- Note: case/esac cannot be used inside $(shell) — Make's parser matches the
  pattern ")" as the function's closing paren before the shell sees it;
  if/elif/else/fi used instead

Dockerfile:
- OCI standard labels added to the final stage via build args (VERSION, GIT_SHA,
  BASE_DIGEST):
    org.opencontainers.image.source    — repo URL
    org.opencontainers.image.version   — semver tag
    org.opencontainers.image.revision  — git commit SHA
    org.opencontainers.image.base.name — alpine:3.21
    org.opencontainers.image.base.digest — digest of base image at build time
- Custom label:
    dev.nochebuena.healthz — /health

Dockerfile

@@ -13,6 +13,18 @@ FROM alpine:3.21
 RUN apk add --no-cache ca-certificates tzdata
 WORKDIR /app
 COPY --from=builder /app/spa-server .
+
+ARG VERSION=dev
+ARG GIT_SHA=unknown
+ARG BASE_DIGEST=
+
+LABEL org.opencontainers.image.source="https://code.nochebuena.dev/einherjar/spa-server"
+LABEL org.opencontainers.image.version="$VERSION"
+LABEL org.opencontainers.image.revision="$GIT_SHA"
+LABEL org.opencontainers.image.base.name="alpine:3.21"
+LABEL org.opencontainers.image.base.digest="$BASE_DIGEST"
+LABEL dev.nochebuena.healthz="/health"
+
 # Mount your SPA dist/ here, or COPY it in a downstream Dockerfile.
 VOLUME ["/srv/www"]
 EXPOSE 8080