Three stages: node:24-alpine builds the Svelte SPA, golang:1.26-alpine
compiles the Go binary with embedded assets (-tags production), and
alpine:3.21 is the minimal runtime.
Runs as unprivileged user (uid 1000). DB_PATH defaults to /data/wotra.db
so a volume mount at /data provides persistent storage.
podman run -e AUTH_TOKEN=secret -p 8080:8080 -v wotra-data:/data wotra
