fix(docker): make server build arch-aware for multi-arch buildx

Cross-compiling x86_64-unknown-linux-musl from an arm64 buildx leg breaks
ring: cc-rs emits -m64 for the x86_64 target but hands it to Debian's
arm64 musl-gcc (shipped for host arch only), whose cc1 has no -m64 →
'cc1: error: unrecognized command-line option "-m64"'.

Each buildx platform leg now builds its own native musl target
(amd64→x86_64, arm64→aarch64) so musl-gcc and the target always match —
no cross-compiler, no QEMU for the compile step. The built binary is
staged at an arch-independent path so the scratch runtime stage can COPY
it without knowing which target was used.

Makefile gains a docker-multiarch target (buildx --platform
linux/amd64,linux/arm64 --push); 'make docker' now uses buildx --load
for local single-arch testing.

Dockerfile

@@ -72,8 +72,10 @@ RUN mkdir -p /usr/local/cargo \
         "${RS_PROXY}" \
         > /usr/local/cargo/config.toml
 
-# Add the targets used by Dioxus fullstack builds.
-RUN rustup target add wasm32-unknown-unknown x86_64-unknown-linux-musl
+# Add the targets used by Dioxus fullstack builds. Both musl targets are
+# installed; each buildx platform leg builds only its native one (see below).
+RUN rustup target add wasm32-unknown-unknown \
+        x86_64-unknown-linux-musl aarch64-unknown-linux-musl
 
 # Install the Dioxus CLI (must match the dioxus crate version).
 RUN cargo install dioxus-cli --version 0.7.9 --locked
@@ -123,15 +125,36 @@ RUN dx build @client --release --debug-symbols=false --wasm-js-cfg false && \
     mkdir -p /build/dist/public && \
     cp -r /build/target/dx/yggdrasil/*/web/public/* /build/dist/public/
 
-# Build the server as a fully static musl binary. musl-gcc is used as the
-# linker driver so that -lc/-ldl are resolved against the static musl C library.
-ENV CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc
-ENV RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static"
-RUN cargo build --release --target x86_64-unknown-linux-musl --no-default-features --features server
+# Build the server as a fully static musl binary, **natively for the buildx
+# platform leg**. Each leg builds only its own arch, so musl-gcc (which Debian
+# ships for the host arch only) and the target always match — no cross-compiler,
+# no QEMU. Cross-compiling here (e.g. building the x86_64 musl target from an
+# arm64 leg) breaks ring: cc-rs emits -m64 for the x86_64 target and hands it to
+# the arm64 musl-gcc, whose cc1 has no -m64 → "unrecognized command-line option".
+RUN ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+        amd64) MUSL_TARGET=x86_64-unknown-linux-musl  ;; \
+        arm64) MUSL_TARGET=aarch64-unknown-linux-musl ;; \
+        *) echo "unsupported arch: $ARCH" >&2; exit 1 ;; \
+    esac \
+    && export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc \
+    && export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc \
+    && export RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static" \
+    && cargo build --release --target "$MUSL_TARGET" --no-default-features --features server
 
 # Ensure the uploads directory exists for runtime image caching.
 RUN mkdir -p uploads
 
+# Stage the built binary + assets at arch-independent paths so the scratch
+# runtime stage can COPY them without knowing which musl target was built.
+RUN ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+        amd64) MUSL_TARGET=x86_64-unknown-linux-musl  ;; \
+        arm64) MUSL_TARGET=aarch64-unknown-linux-musl ;; \
+        *) echo "unsupported arch: $ARCH" >&2; exit 1 ;; \
+    esac \
+    && cp "/build/target/${MUSL_TARGET}/release/yggdrasil" /build/server
+
 # -----------------------------------------------------------------------------
 # Runtime stage: minimal scratch image with the static musl binary
 # -----------------------------------------------------------------------------
@@ -140,7 +163,7 @@ FROM scratch
 WORKDIR /app
 
 # Copy the static musl server binary and the bundled public assets.
-COPY --from=builder --chown=65534:65534 /build/target/x86_64-unknown-linux-musl/release/yggdrasil /app/server
+COPY --from=builder --chown=65534:65534 /build/server /app/server
 COPY --from=builder --chown=65534:65534 /build/dist/public /app/public
 COPY --from=builder --chown=65534:65534 /build/uploads /app/uploads
 

Makefile

@@ -151,8 +151,24 @@ doc:
 doc-open:
 	@RUSTDOCFLAGS="--default-theme=ayu" cargo doc --no-deps --document-private-items --open
 
+# Multi-arch image build via buildx. The Dockerfile builds each platform leg
+# natively (amd64→x86_64 musl, arm64→aarch64 musl), so no cross-compiler or
+# QEMU is needed. Docker Desktop ships a buildx builder that handles this.
+#
+#   make docker              native arch only, load into local daemon (for testing)
+#   make docker-multiarch    build amd64+arm64 and push to a registry
+#                            (multi-arch manifests can't be --load-ed locally)
+#
+# Push examples:
+#   make docker-multiarch IMAGE=ghcr.io/owner/yggdrasil:latest
+#   make docker-multiarch IMAGE=user/yggdrasil:v1 PLATFORMS=linux/amd64
+IMAGE ?= yggdrasil
+PLATFORMS ?= linux/amd64,linux/arm64
 docker:
-	@docker build -t yggdrasil .
+	@docker buildx build --load -t yggdrasil .
+
+docker-multiarch:
+	@docker buildx build --platform $(PLATFORMS) -t $(IMAGE) --push .
 
 clean:
 	@cargo clean