ci: self-contained secs_server image for secs4j interop

The harness previously bound the source tree into a compose service
and built inside it.  That breaks under docker-in-docker (gitea-act,
GitHub Actions runners with /var/run/docker.sock mounted) because
bind-mount sources resolve against the *host* daemon's filesystem,
not the runner container's.  Now Dockerfile.server bakes a Release
secs_server into its own image, and secs4j_validate.sh wires server
and harness together on a dedicated bridge — no volumes needed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

interop/Dockerfile.server

@@ -0,0 +1,45 @@
+# Self-contained secs_server image for the secs4j interop harness.
+#
+# The dev-time `server` compose service bind-mounts the source tree
+# read-write at /app and lets the in-container `builder` step compile
+# there.  That works on a developer laptop but breaks under docker-
+# in-docker (gitea-act / GitHub Actions runners with a mounted
+# /var/run/docker.sock): the bind-mount source resolves against the
+# *host* daemon's filesystem, not the runner container's, so /app
+# mounts empty and the build / launch silently fails.
+#
+# This image bakes the source + Release binary in at build time so
+# `docker run` of it needs no volumes at all — same pattern already
+# used by interop/secs4j/Dockerfile for the Java harness.
+FROM ubuntu:24.04 AS build
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential cmake ninja-build \
+        libasio-dev libyaml-cpp-dev \
+        python3 python3-yaml \
+        git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /src
+COPY . /src
+RUN cmake -S /src -B /src/build -G Ninja -DCMAKE_BUILD_TYPE=Release \
+ && cmake --build /src/build --target secs_server
+
+
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        libyaml-cpp0.8 \
+    && rm -rf /var/lib/apt/lists/*
+
+# WORKDIR must be the directory holding `data/` because secs_server's
+# default --config / --state-table paths are relative ("data/...").
+WORKDIR /app
+COPY --from=build /src/build/secs_server /usr/local/bin/secs_server
+COPY data /app/data
+
+EXPOSE 5000
+ENTRYPOINT ["/usr/local/bin/secs_server"]
+CMD ["--port", "5000", "--device", "0"]