feat(ci): add Docker build pipeline with version management

- Add multi-stage Dockerfile with pinned tool versions (Node 24.10.0, Go 1.25.1, Hugo 0.151.0)
- Create .env.versions as single source of truth for all tool versions
- Add GitHub Actions CI workflow for automated OCI image builds
  - Multi-arch support (amd64, arm64)
  - Automatic version loading from .env.versions
  - Docker registry push with metadata tags
- Add Taskfile tasks for local OCI image building and testing
  - task build:oci-image - Build with version-pinned dependencies
  - task test:oci-image - Build and test container locally
- Pin devbox.json to specific versions matching .env.versions
- Add comprehensive documentation (DOCKER.md, VERSIONS.md)
- Add helper script (scripts/get-versions.sh) for version extraction

This enables consistent development and production environments with
identical tool versions across local devbox, Docker builds, and CI/CD.

Dockerfile

@@ -0,0 +1,66 @@
+# Build arguments for version pinning (matching devbox.json)
+ARG NODE_VERSION=24.10.0
+ARG GO_VERSION=1.25.1
+ARG HUGO_VERSION=0.151.0
+
+# Build stage - use same versions as local devbox environment
+FROM node:${NODE_VERSION}-bookworm AS builder
+
+# Install Git (needed for Hugo's enableGitInfo)
+RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
+
+# Install Go
+ARG GO_VERSION
+RUN wget -q https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz && \
+    tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \
+    rm go${GO_VERSION}.linux-amd64.tar.gz
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+ENV GOPATH="/go"
+ENV PATH="${GOPATH}/bin:${PATH}"
+
+# Install Hugo extended
+ARG HUGO_VERSION
+RUN wget -q https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz && \
+    tar -xzf hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz && \
+    mv hugo /usr/local/bin/ && \
+    rm hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz && \
+    hugo version
+
+WORKDIR /src
+
+# Copy package files and install npm dependencies
+COPY package*.json ./
+RUN npm ci
+
+# Copy all source files
+COPY . .
+
+# Build Hugo site (Git info wird aus dem aktuellen Kontext genommen, nicht aus .git)
+# Hugo sucht nach .git, findet es nicht, und überspringt Git-Info automatisch
+RUN hugo --gc --minify
+
+# Runtime stage - nginx to serve static content
+FROM nginx:1.27-alpine
+
+# Copy built site from builder
+COPY --from=builder /src/public /usr/share/nginx/html
+
+# Copy custom nginx config
+RUN echo 'server {' > /etc/nginx/conf.d/default.conf && \
+    echo '    listen 80;' >> /etc/nginx/conf.d/default.conf && \
+    echo '    server_name _;' >> /etc/nginx/conf.d/default.conf && \
+    echo '    root /usr/share/nginx/html;' >> /etc/nginx/conf.d/default.conf && \
+    echo '    index index.html;' >> /etc/nginx/conf.d/default.conf && \
+    echo '' >> /etc/nginx/conf.d/default.conf && \
+    echo '    location / {' >> /etc/nginx/conf.d/default.conf && \
+    echo '        try_files $uri $uri/ /index.html;' >> /etc/nginx/conf.d/default.conf && \
+    echo '    }' >> /etc/nginx/conf.d/default.conf && \
+    echo '' >> /etc/nginx/conf.d/default.conf && \
+    echo '    gzip on;' >> /etc/nginx/conf.d/default.conf && \
+    echo '    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;' >> /etc/nginx/conf.d/default.conf && \
+    echo '}' >> /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+
+CMD ["nginx", "-g", "daemon off;"]