fix: use docker-container buildx driver to resolve mount permission errors (#191)

The production deployment was failing with "operation not permitted" errors
when BuildKit tried to perform bind mounts during Docker image builds.

Root cause:
- The workflow starts Docker with --storage-driver=vfs for unprivileged runners
- VFS storage driver doesn't support the advanced mount operations needed by BuildKit
- The Dockerfile uses --mount=type=cache for build performance
- Using buildx driver=docker tried to use the daemon's VFS storage directly

Solution:
- Switch to driver=docker-container which runs BuildKit in an isolated container
- This container has its own storage layer that properly supports BuildKit features
- BuildKit container uses overlay2 internally regardless of host storage driver

This is the recommended approach for CI/CD environments with storage limitations.

Reviewed-on: graham/towerops-web#191

.forgejo/workflows/production.yaml

@@ -118,7 +118,9 @@ jobs:
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
         with:
-          driver: docker
+          driver: docker-container
+          driver-opts: |
+            image=moby/buildkit:latest
           install: true
           cleanup: true