ci: prebuilt image on GHCR + docker run one-liner

.github/workflows/ghcr.yml

@@ -0,0 +1,49 @@
+# Build & publish the container image to GHCR on every release (and on
+# demand), so self-hosters can `docker run ghcr.io/noddle-dev/noddle-draw`
+# without cloning the repo. Multi-arch: amd64 + arm64 (Raspberry Pi/ARM VPS
+# are common in the self-host crowd).
+name: Publish image (GHCR)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

README.md

@@ -104,7 +104,17 @@ docker compose up --build
 # → http://localhost:8000  — start drawing, no sign-up
 ```
 
-One container (FastAPI + prebuilt React SPA) plus Postgres. Without Docker:
+One container (FastAPI + prebuilt React SPA) plus Postgres.
+
+Prefer a prebuilt image (no clone, no build)? Once the release image is
+published to GHCR you can run it directly — single container, file storage,
+no Postgres:
+
+```bash
+docker run -p 8000:8000 -v noddle_draw:/app/backend/storage ghcr.io/noddle-dev/noddle-draw:latest
+```
+
+Without Docker:
 
 ```bash
 # backend