build: add pinned Linux server image

Dockerfile.server

@@ -0,0 +1,27 @@
+FROM golang:1.25.1-bookworm@sha256:c423747fbd96fd8f0b1102d947f51f9b266060217478e5f9bf86f145969562ee AS build
+
+WORKDIR /src/go
+COPY go/go.mod go/go.sum ./
+RUN go mod download
+COPY go/ ./
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -tags release -trimpath -ldflags="-s -w" -o /out/bd2server ./cmd/bd2server
+
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid 10001 bd2 \
+    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin bd2
+
+WORKDIR /app
+COPY --from=build /out/bd2server /app/bd2server
+COPY versions.json authentication.json resources.json /app/
+COPY go/seed /app/go/seed
+RUN mkdir -p /app/data && chown 10001:10001 /app/data
+
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["/app/bd2server"]
+CMD ["serve", "--listen", "0.0.0.0:8080", "--data-dir", "/app/data"]

Dockerfile.server.dockerignore

@@ -0,0 +1,6 @@
+*
+!go/
+!go/**
+!versions.json
+!authentication.json
+!resources.json