Publish multi-platform Docker images (linux/amd64 + linux/arm64)

[gangtao]

Problem

Both published images are built for linux/amd64 only:

• timeplus/tpk-app — .github/workflows/docker-publish.yml line 66: platforms: linux/amd64
• timeplus/tpk (all-in-one) — .github/workflows/docker-publish.yml line 118: platforms: linux/amd64

On Apple Silicon (M-series) and Graviton/ARM Kubernetes nodes, docker pull timeplus/tpk either fails (no matching manifest for linux/arm64/v8) or silently runs under QEMU emulation with --platform linux/amd64, which is slow and unreliable for timeplusd/proton. The README's one-command all-in-one quick start (#70) therefore doesn't work out of the box on a Mac.

Feasibility

All base images in deploy/docker/Dockerfile already publish arm64 manifests (verified with docker manifest inspect):

Stage	Base image	arm64?
webbuild	node:22-alpine	✅
pybuild / app	debian:12-slim	✅
allinone	ghcr.io/timeplus-io/proton:latest	✅

So no Dockerfile base-image changes are needed; this is a CI change plus verification that the Python deps have arm64 wheels.

Proposed change

1. In docker-publish.yml, for both app and allinone jobs:
   • add docker/setup-qemu-action@v3 before setup-buildx-action
   • set platforms: linux/amd64,linux/arm64 on docker/build-push-action
   • buildx pushes a single multi-arch manifest list per tag (latest, sha, semver), so no tag scheme changes.
2. Keep the PR smoke build on linux/amd64 only (no push) to keep PR CI fast; do the full multi-arch build on push/tag/dispatch.
3. Verify the pybuild stage under arm64: every dependency in pyproject.toml must have an aarch64 wheel or build cleanly from source on debian:12-slim (watch for anything pulling in native extensions). If a source build is needed, add the build deps to the pybuild stage only.
4. Optionally use runs-on: ubuntu-24.04-arm native runners with a manifest-merge step instead of QEMU if emulated builds turn out too slow (proton image is large).
5. Update Makefile docker-build* targets (lines ~101–104) to accept an optional PLATFORMS var for local multi-arch builds, and note in the README/deploy/docker docs that images are now multi-arch.

Acceptance criteria

• docker manifest inspect timeplus/tpk:latest and timeplus/tpk-app:latest list both amd64 and arm64.
• docker compose -f docker-compose.allinone.yml up runs natively on an Apple Silicon Mac without --platform.
• The app image runs on an arm64 k8s node (e.g. Graviton) with the existing Helm chart unchanged.
• amd64 image behaviour and tags are unchanged.