Fix SHA tag prefix in Docker metadata to prevent invalid image tags

[henmohr]

Motivation

• Prevent invalid image tags emitted by the Docker metadata action on PR builds by replacing branch-based SHA prefix interpolation with a stable prefix.
• Keep app and web images as separately buildable artifacts so each image can be built, tagged, and published independently.

Description

• Change SHA tag generation from type=sha,prefix={{branch}}- to type=sha,prefix=sha- to avoid empty-prefix tags like :-<sha> which are invalid.
• Add IMAGE_NAME_APP and IMAGE_NAME_WEB environment variables and split metadata extraction into meta_app and meta_web steps.
• Split build steps to use context: .docker/app and context: .docker/web and wire tags/labels to steps.meta_app.outputs and steps.meta_web.outputs respectively.
• Preserve cache-from and cache-to settings and multi-platform targets while clarifying step names.

Testing

• No automated tests were run because this change only updates the GitHub Actions workflow and will be exercised by CI on the next push.

---

Codex Task