Modernize Docker build infrastructure: multi-arch GitHub Actions + buildkit strategy

[Copilot]

Replaces the outdated single-arch CircleCI + GitHub Actions setup with the proven multi-platform buildkit strategy from balena-photo-cropper. Adds full armhf/aarch64/x86_64 matrix builds, GHA layer caching, buildkit secret mounts, and manifest merging.

CI/CD

• New .github/workflows/docker-build.yml — replaces build.yml; uses docker/bake-action@v5, full 3-arch matrix, separated "Write buildkit secrets" step, GHA cache injection, manifest merge in deploy job
• Removed .circleci/config.yml and .github/workflows/build.yml
• Explicit permissions: contents: read / actions: write on both jobs (least-privilege)

docker-bake.hcl

• Added REGISTRY, REGISTRY_IMAGE, GITHUB_SHA variables
• New common target inheriting GHA cache (type=gha) — all service targets inherit it
• Per-arch groups armhf / aarch64 / x86_64, each building all 4 services with platform-suffixed tags (arm32v7, arm64v8, amd64) plus branch-safe and SHA tags

target "common" {
  cache-from = ["type=gha"]
  cache-to   = ["type=gha,mode=max"]
}

target "php-fpm-x86_64" {
  inherits   = ["php-fpm"]
  platforms  = ["linux/amd64"]
  dockerfile = "Dockerfile.x86_64"
  tags = [
    "${REGISTRY}/${REGISTRY_IMAGE}/php-fpm:amd64",
    BAKE_TAG != "" ? "…:${BAKE_TAG}-amd64" : "",
    GITHUB_SHA != "" ? "…:${GITHUB_SHA}-amd64" : ""
  ]
}

manifest-push.sh (new)

• Sources common.env for BALENA_PROJECTS, parses REGISTRY/DOCKER_ORG from docker-bake.hcl
• Merges per-arch images into a single multi-platform manifest; pushes latest on main/development

common.env

• BALENA_PROJECTS updated from path-based entries to service names: ( php-fpm httpd mysqldb balena-storage )

Dockerfiles

• PHP base image bumped 7.4.33-fpm-alpine3.16 → 8.3-fpm-alpine across all arch variants and template (PHP 8.1+ required for CakePHP 5)
• Node build stage pinned to node:20-alpine (drops end-of-life alpine 3.16)