fix(docker): multi-stage build and publish tags

- Split Dockerfile into builder and runtime stages
- Put .venv on PATH so pymodbus resolves in the container
- Push image to Docker Hub and GHCR with latest and 7-char SHA tags
- Use real repo/image names in README

.github/workflows/docker-publish.yml

@@ -1,4 +1,4 @@
-name: Build and Push to Docker Hub
+name: Build and Push Docker Image
 
 on:
   push:
@@ -9,9 +9,12 @@ on:
     branches: [main]
 
 env:
-  REGISTRY: docker.io
   IMAGE_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/modbus-slave
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -30,17 +33,27 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.IMAGE_NAME }}
+          images: |
+            ${{ env.IMAGE_NAME }}
+            ghcr.io/${{ github.repository }}
           tags: |
-            type=ref,event=branch
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=sha,prefix=
 
       - name: Build and push
         uses: docker/build-push-action@v6