CI: fix docker multi-arch crash + add one-click version-bump workflow

docker-publish.yml:
  - Dropped linux/arm64 from the platforms matrix. The amd64 GitHub-
    hosted runner builds arm64 under QEMU emulation, which fails at
    native argon2 compile with SIGILL (exit 132). Your production
    box is x86, so arm64 isn't needed. Add it back with a native
    ARM runner the day you deploy to ARM hardware.

version-bump.yml (new):
  - Manual Actions trigger. Click "Run workflow" → pick patch / minor /
    major (or type a custom X.Y.Z). The workflow computes the next
    semver from the current package.json version, updates all three
    version sites (package.json, mobile/package.json, Android
    versionName + versionCode), commits "Release vX.Y.Z", tags it,
    and pushes. The tag push then fires android-release.yml and
    docker-publish.yml automatically — APK + Docker image published
    with no local commands required.

Typical flow now:
  Actions → "Version bump & release" → Run workflow → patch
    ↓
  Bump + tag in ~5 s
    ↓
  Parallel: android APK build (~2 m), docker image push (~4 m)
    ↓
  Both assets show up on the new release; Obtanium + docker-hub
  subscribers see the update automatically.

.github/workflows/docker-publish.yml

@@ -49,7 +49,11 @@ jobs:
             danielonyejesi/pediatric-ai-scribe-v3:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          platforms: linux/amd64,linux/arm64
+          # x86 only — argon2 native build fails under QEMU ARM64
+          # emulation on a GitHub-hosted amd64 runner (SIGILL / exit 132).
+          # Add linux/arm64 back with a native ARM runner when/if you
+          # actually deploy to ARM hardware.
+          platforms: linux/amd64
 
       - name: Summary
         run: |

.github/workflows/version-bump.yml

@@ -0,0 +1,99 @@
+name: Version bump & release
+
+# Manual trigger — click "Run workflow" in the Actions tab, choose
+# patch / minor / major. The workflow computes the next semver,
+# updates package.json, mobile/package.json, and the Android
+# build.gradle, commits the change, tags it, and pushes — which
+# triggers the android-release and docker-publish workflows.
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: 'Semver bump type'
+        required: true
+        type: choice
+        default: patch
+        options:
+          - patch
+          - minor
+          - major
+      custom:
+        description: 'Or exact version (e.g. 7.0.0) — overrides bump'
+        required: false
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute next version
+        id: v
+        run: |
+          CUR=$(grep -m1 '"version"' package.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+          echo "current=$CUR"
+          IFS='.' read -r MAJ MIN PAT <<< "$CUR"
+
+          if [[ -n "${{ github.event.inputs.custom }}" ]]; then
+            NEXT="${{ github.event.inputs.custom }}"
+          else
+            case "${{ github.event.inputs.bump }}" in
+              major) NEXT="$((MAJ+1)).0.0" ;;
+              minor) NEXT="${MAJ}.$((MIN+1)).0" ;;
+              patch) NEXT="${MAJ}.${MIN}.$((PAT+1))" ;;
+            esac
+          fi
+
+          if ! [[ "$NEXT" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::invalid version: $NEXT"; exit 1
+          fi
+          echo "next=$NEXT" >> "$GITHUB_OUTPUT"
+          echo "current=$CUR" >> "$GITHUB_OUTPUT"
+          echo "### Version bump" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Current: $CUR" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Next:    $NEXT" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Configure git
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Bump version strings
+        env:
+          V: ${{ steps.v.outputs.next }}
+        run: |
+          IFS='.' read -r MAJ MIN PAT <<< "$V"
+          ANDROID_CODE=$(( MAJ * 100000 + MIN * 1000 + PAT ))
+
+          # package.json (top-level "version": "...")
+          sed -i -E "0,/(\"version\"[[:space:]]*:[[:space:]]*\")[^\"]+(\")/ s//\1${V}\2/" package.json
+          sed -i -E "0,/(\"version\"[[:space:]]*:[[:space:]]*\")[^\"]+(\")/ s//\1${V}\2/" mobile/package.json
+
+          # Android
+          sed -i -E \
+            -e "s/versionCode +[0-9]+/versionCode ${ANDROID_CODE}/" \
+            -e "s/versionName +\"[^\"]+\"/versionName \"${V}\"/" \
+            mobile/android/app/build.gradle
+
+          git diff --stat
+
+      - name: Commit, tag, push
+        env:
+          V: ${{ steps.v.outputs.next }}
+        run: |
+          git add package.json mobile/package.json mobile/android/app/build.gradle
+          git commit -m "Release v${V}"
+          git tag -a "v${V}" -m "Release v${V}"
+          git push origin HEAD
+          git push origin "v${V}"
+          echo "### Pushed" >> "$GITHUB_STEP_SUMMARY"
+          echo "- tag: v${V}" >> "$GITHUB_STEP_SUMMARY"
+          echo "- android-release + docker-publish workflows will now run" >> "$GITHUB_STEP_SUMMARY"