Publish a Docker image, drop-in for OpenAI

[crp4222]

Makes the proxy pullable and drop-in.

• Dockerfile: pick config/privaite.openai.yaml when OPENAI_API_KEY is set (docker run -e OPENAI_API_KEY=... just works), else a mounted config/privaite.yaml, else the Ollama example. The detection model stays baked in, so the container runs offline from the first request.
• config/privaite.openai.yaml: exposes gpt-4o-mini and gpt-4o via the standard OpenAI provider.
• ci: build and push multi-arch (linux/amd64, linux/arm64) to ghcr.io/crp4222/privaite on release, plus manual dispatch.
• docs: README docker quickstart with both examples (OpenAI env, mounted config); drop the pypi/dm downloads badge, which the upstream service rate-limits and currently renders as an error.

Tested locally: image builds for amd64 and arm64; boots, health ok, auth enforced (401 without key). PII detection, round-trip restore, streaming, and tool-call argument restore all verified against a cloud model and through Open WebUI. The three config-selection branches each pick the right config.