Add docker-smoke composite action

[aaronelliotross]

Shared composite action that builds the repo's Docker image, runs the container, and curls it with the production Host header — asserting the expected HTTP status.

Catches two bug classes a plain build check misses:

1. Image build breaks (e.g. a base-image bump dropping a tool — like node 26-alpine no longer shipping corepack).
2. Runtime serving breaks under the real hostname (e.g. Vite preview's allowedHosts returning 403 for an unlisted Host) — which broke toolbox.wemove.eu.

Used as a step inside a job named ci so the required-status-check context stays exactly ci (a reusable workflow would yield ci / <job> and break the org ruleset match).

After merge: cut tag v14; consumers reference WeMoveEU/ci-workflows/.github/actions/docker-smoke@v14.