Publish arm64 alongside amd64

muse is now the front door of a public project, and it was the only
image in that stack without an arm64 build. Raspberry Pis, arm64 NASes
and Ampere VPSes are a large share of self-hosters, so amd64-only made
the whole stack un-runnable for them — gluetun, slskd, soularr, lidarr,
navidrome and the socket proxy all already publish both.

Three parts, because changing `platforms:` alone would have failed:

- setup-qemu-action registers the binfmt handlers buildx needs to
  produce arm64 on an amd64 runner. Without it the build errors with
  "exec format error"; it does not quietly fall back to amd64.
- The web stage is pinned to --platform=$BUILDPLATFORM so the Next.js
  build runs natively once instead of being emulated per platform. It
  is the expensive step, and its output is static HTML/JS/CSS with no
  native code, so the bytes are identical either way. This is what
  makes the old comment's "3-5x slower for nothing" no longer true.
- platforms: linux/amd64,linux/arm64.

Verified locally before pushing: both platforms build in ~52s, and the
loaded arm64 image reports aarch64 with uvloop, watchfiles, httptools
and pydantic_core all importing, `import app` succeeding, and the
static UI present.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Dockerfile

@@ -4,7 +4,18 @@
 # HTML/JS/CSS, so Node never runs in the final image and the runtime stays a
 # single Python process — same container, same healthcheck, same everything
 # the deploy already expects.
-FROM node:22-slim AS web
+#
+# --platform=$BUILDPLATFORM pins this stage to the NATIVE architecture of
+# whatever is doing the building, instead of the architecture being built
+# FOR. That matters now that this image is multi-arch: without it, the arm64
+# image would run `npm ci` and `npm run build` under QEMU emulation, which is
+# by far the slowest thing in this file — several minutes, repeated per
+# platform.
+#
+# It is safe precisely because the output is static HTML/JS/CSS. There is no
+# native code in `out/`, so bytes built on amd64 are byte-identical to bytes
+# built on arm64, and stage 2 just copies them in.
+FROM --platform=$BUILDPLATFORM node:22-slim AS web
 
 WORKDIR /web
 
@@ -18,8 +29,15 @@ RUN npm run build
 
 # ── stage 2: runtime ────────────────────────────────────────────────────
 #
-# Slim, no build toolchain needed — every Python dependency ships wheels for
-# linux/amd64 on py3.12.
+# Slim, no build toolchain needed — every Python dependency ships prebuilt
+# wheels on py3.12 for BOTH linux/amd64 and linux/arm64. fastapi, httpx and
+# mutagen are pure Python; uvicorn[standard]'s compiled extras (uvloop,
+# httptools, watchfiles) all publish aarch64 manylinux wheels.
+#
+# That is what keeps the emulated arm64 build cheap: pip downloads wheels
+# rather than invoking a compiler under QEMU. If a dependency is ever added
+# that has no aarch64 wheel, this build will suddenly take ten minutes and
+# need gcc — that is the signal to switch to a native arm64 runner.
 FROM python:3.12-slim
 
 WORKDIR /app