fix: docker build context and validation (#324)

Updates Dockerfile and Fly config to build from the project root context, allowing access to root-level files like README.md. Adds a CI workflow to validate the Docker build on PRs.

.github/workflows/build-docker.yml

···
+name: validate docker build
+
+on:
+  pull_request:
+    paths:
+      - "backend/src/**"
+      - "backend/Dockerfile"
+      - "backend/pyproject.toml"
+      - "backend/uv.lock"
+      - "README.md"
+      - ".github/workflows/build-docker.yml"
+
+jobs:
+  build:
+    name: build backend image
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: set up docker buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: build docker image
+        # Build from root context using backend/Dockerfile
+        run: docker build -f backend/Dockerfile .

.github/workflows/deploy-prod.yml

···
           if [ "${{ steps.changes.outputs.migrations }}" == "true" ]; then
             echo "🔄 migrations detected - will run via release_command before deployment"
           fi
-          cd backend
-          flyctl deploy --config fly.toml --remote-only -a relay-api
+          flyctl deploy --config backend/fly.toml --remote-only -a relay-api
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN_PROD }}

.github/workflows/deploy-staging.yml

···
           if [ "${{ steps.changes.outputs.migrations }}" == "true" ]; then
             echo "🔄 migrations detected - will run via release_command before deployment"
           fi
-          cd backend
-          flyctl deploy --config fly.staging.toml --remote-only -a relay-api-staging
+          flyctl deploy --config backend/fly.staging.toml --remote-only -a relay-api-staging
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN_STAGING }}

backend/Dockerfile

···
 WORKDIR /app
 
 # install dependencies (separate layer for better caching)
-COPY pyproject.toml uv.lock README.md ./
+# COPY paths are relative to the build context (root)
+COPY backend/pyproject.toml backend/uv.lock README.md ./
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-install-project --compile-bytecode
 
 # copy application code
-COPY src ./src
+COPY backend/src ./src
 
 # copy alembic migration files
-COPY alembic.ini ./
-COPY alembic ./alembic
+COPY backend/alembic.ini .
+COPY backend/alembic ./alembic
 
 # install the project itself with bytecode compilation
 RUN --mount=type=cache,target=/root/.cache/uv \
···
 EXPOSE 8000
 
 # run the application
-CMD ["uv", "run", "uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["uv", "run", "uvicorn", "backend.main:app", "--host", "0.0.0.0", "--port", "8000"]

backend/fly.staging.toml

···
 primary_region = 'iad'
 
 [build]
+  dockerfile = "backend/Dockerfile"
+  ignore_file = "backend/.dockerignore"
 
 [deploy]
   release_command = 'uv run alembic upgrade head'
···
 [[vm]]
   memory = '1gb'
   cpu_kind = 'shared'
-  cpus = 1
+  cpus = 1

backend/fly.toml

···
 primary_region = 'iad'
 
 [build]
+  dockerfile = "backend/Dockerfile"
+  ignore_file = "backend/.dockerignore"
 
 [deploy]
   release_command = "uv run alembic upgrade head"
···
 # - AWS_SECRET_ACCESS_KEY
 # - ATPROTO_CLIENT_ID (will be https://api.plyr.fm/client-metadata.json after deployment)
 # - ATPROTO_REDIRECT_URI (will be https://api.plyr.fm/auth/callback after deployment)
-# - OAUTH_ENCRYPTION_KEY (44-character base64 Fernet key, generate with: python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')
+# - OAUTH_ENCRYPTION_KEY (44-character base64 Fernet key, generate with: python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')