QBBB-FEAT-005 - Headless nox Linux build + GHCR Docker image

[itlezy]

Add a headless nox Linux build of the qBittorrentBB fork and publish it as a linuxserver-style Docker image to GHCR (ghcr.io/emulebb/qbittorrentbb-nox, latest + versioned), built and pushed by this repo's CI.

This is the enabling prerequisite for the suite Docker bundle — the bundle's BitTorrent client runs headless in a container. Design: emulebb-tooling docs/active/SUITE-DOCKER.md.

Shape:

• Build qbittorrent-nox (no GUI) for Linux from the fork, preserving the DHT harvester + Torznab + BB export features.
• linuxserver convention: s6-overlay, PUID/PGID, TZ, /config + /data.
• Downloads under /data/torrents for hardlink + atomic-move to /data/media.
• Runs behind an optional Gluetun namespace; WebUI + BT listen ports published on the fronting gluetun service.
• Keep the fail-closed VPN binding semantics (see QBBB-FEAT-004) coherent inside the container/Gluetun model.

Acceptance:

• CI produces a qbittorrent-nox Linux binary from the fork.
• CI builds and pushes ghcr.io/emulebb/qbittorrentbb-nox:latest + a version tag on release.
• WebUI + BT reachable when ports are published on a fronting service; /config + /data persisted.

Tracked on the eMuleBB Suite board (Product = qBittorrentBB, Phase 2).