feat: add Docker Hub as primary registry for anonymous pulls

GHCR requires authentication even for public packages on some systems.
CI now pushes to both GHCR and Docker Hub. docker-compose.yml and Helm
chart point to Docker Hub where anonymous pulls always work. Build
directives kept as fallback for source-based builds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -1,6 +1,9 @@
 services:
   backend:
-    image: ghcr.io/bigbodycobain/shadowbroker-backend:latest
+    image: bigbodycobain/shadowbroker-backend:latest
+    build:
+      context: .
+      dockerfile: backend/Dockerfile
     container_name: shadowbroker-backend
     ports:
       - "${BIND:-127.0.0.1}:8000:8000"
@@ -33,7 +36,9 @@ services:
           cpus: '2'
 
   frontend:
-    image: ghcr.io/bigbodycobain/shadowbroker-frontend:latest
+    image: bigbodycobain/shadowbroker-frontend:latest
+    build:
+      context: ./frontend
     container_name: shadowbroker-frontend
     ports:
       - "${BIND:-127.0.0.1}:3000:3000"