build: add Dockerfile for the message-plane server

Multi-stage build (golang:1.26 -> distroless/static-nonroot), CGO disabled,
GOPRIVATE set for the kmsvc-proto module fetch.

Dockerfile

@@ -0,0 +1,12 @@
+FROM golang:1.26 AS build
+WORKDIR /src
+ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -o /out/kmsvc-server ./cmd/server
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/kmsvc-server /kmsvc-server
+USER nonroot:nonroot
+ENTRYPOINT ["/kmsvc-server"]