fix(docker): refactor to multi-stage build (#89)

[Philzwrist07]

Closes #89 Resolves #89. The previous Dockerfile used a single stage, shipping the full Rust toolchain
(~1.5 GB) in the final image alongside the WASM artifacts. This PR splits the build into two
stages, reducing the final image to a minimal Debian base with only the compiled artifacts and
Stellar CLI.

Changes

Dockerfile

• builder stage — rust:1.75-slim-bookworm — installs toolchain, adds wasm32-unknown-unknown
  target, and compiles WASM binaries
• runtime stage — debian:bookworm-slim — copies only *.wasm artifacts from builder; installs
  Stellar CLI and nothing else
• Both base images pinned to a specific digest for reproducible builds
• Removed curl, git, and other dev-only packages from the final image

README

• Added stage table documenting the purpose of each build stage
• Added explicit docker build --target commands for both the runtime image and the builder-only
  image (useful for CI)

Testing

Build runtime image (final artifact)

docker build --target runtime -t cosmosvote:latest .

Build builder image and run tests

docker build --target builder -t cosmosvote:builder .
docker run --rm cosmosvote:builder make test

Acceptance Criteria

• Multi-stage build: builder compiles WASM, runtime contains only artifacts
• Final image size reduced >50% (Debian slim + Stellar CLI vs full Rust toolchain)
• Base images pinned to digest for reproducibility
• README documents the image build process