Clean up build tooling and Dockerfile

- Dockerfile cross-compiles Go for the target platform (amd64/arm64
  without emulation), uses templ pinned in go.mod, runs as uid 1000 on
  alpine and lets FRONTEND_IMAGE pin the frontend version
- justfile: tools via go tool, `test` (unit) and `test-integration`
  (uses the active docker context), no hardcoded paths, no tailwind or
  frontend recipes
- Removed app.yaml, init.sh, tailwind.config.js and the tracked .idea
  folder

Dockerfile

@@ -1,36 +1,39 @@
-# Stage 1: Build backend
-FROM golang:1.25-alpine as build_go
-RUN apk add --no-cache curl
+# The frontend is built and published separately; override to pin a version.
+ARG FRONTEND_IMAGE=gitea.sanplex.xyz/sansan/musicfrontend:latest
+
+# Stage 1: Build the backend on the build machine and cross-compile for the target platform,
+# so multi-platform builds need no emulation.
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
+ARG TARGETOS TARGETARCH
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
 COPY cmd/ ./cmd/
 COPY internal/ ./internal/
-RUN find . -name "*_test.go" -delete && \
-    find . -name "integration_test.go" -delete
-RUN go install github.com/a-h/templ/cmd/templ@latest
-RUN templ generate
-RUN go build -o main cmd/main.go
+RUN go tool templ generate
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build -trimpath -ldflags="-s -w" -tags timetzdata -o main ./cmd
 
-# Stage 2: Final image
-FROM golang:1.25-alpine
+# Stage 2: Frontend static files (the same for every platform)
+FROM --platform=$BUILDPLATFORM ${FRONTEND_IMAGE} AS frontend
+# Empty API_HOSTNAME makes the frontend use relative paths
+RUN echo "window.__RUNTIME_CONFIG__ = { API_HOSTNAME: '' };" > /usr/share/nginx/html/config.js
+
+# Stage 3: Final image. No RUN steps here, so no emulation is needed for other architectures.
+FROM alpine:3.22
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+WORKDIR /app
+COPY --from=build /app/main .
+COPY --from=frontend /usr/share/nginx/html /frontend
+COPY ./songs/ ./songs/
+
+# The music volume must be readable by uid 1000, and writable for the .id file cleanup during sync.
+USER 1000:1000
 EXPOSE 8080
 VOLUME /sorted
 VOLUME /characters
 
-COPY --from=build_go /app/main .
-COPY --from=gitea.sanplex.xyz/sansan/musicfrontend:latest /usr/share/nginx/html /frontend
-# Generate config.js with empty API_HOSTNAME (relative paths)
-RUN echo "window.__RUNTIME_CONFIG__ = { API_HOSTNAME: '' };" > /frontend/config.js
-COPY ./songs/ ./songs/
+# Required: DB_HOST, DB_PORT, DB_USERNAME, DB_PASSWORD, DB_NAME, MUSIC_PATH, CHARACTERS_PATH
+ENV PORT=8080
 
-ENV PORT 8080
-ENV DB_HOST ""
-ENV DB_PORT ""
-ENV DB_USERNAME ""
-ENV DB_PASSWORD ""
-ENV DB_NAME ""
-ENV MUSIC_PATH ""
-ENV CHARACTERS_PATH ""
-
-CMD ./main
+CMD ["./main"]