fix: take a dockerfile input alongside context in app-build/app-release

A generated project's context alone can no longer name the Dockerfile
too: an all-typescript project builds from the workspace root, where
the Dockerfile that root context needs lives at apps/<role>/Dockerfile,
not context/Dockerfile. Same shape as immich's own docker.yml call
site (context: ., dockerfile: server/Dockerfile). scaffold's build.yml
and release.yml call sites now pass both.

Claude-Session: https://claude.ai/code/session_01J4HB8qJjdZwaAv42k6HMpv

Author: nghiatruongtps

.github/workflows/app-build.yml

@@ -9,6 +9,10 @@ on:
       context:
         type: string
         required: true
+      dockerfile:
+        description: path to the Dockerfile, relative to the checkout root
+        type: string
+        required: true
 
 permissions: {}
 
@@ -38,6 +42,7 @@ jobs:
       - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.context }}
+          file: ${{ inputs.dockerfile }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           cache-from: type=gha

.github/workflows/app-release.yml

@@ -8,6 +8,10 @@ on:
       context:
         type: string
         required: true
+      dockerfile:
+        description: path to the Dockerfile, relative to the checkout root
+        type: string
+        required: true
     secrets:
       RELEASE_APP_ID:
         required: false
@@ -87,6 +91,7 @@ jobs:
       - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ inputs.context }}
+          file: ${{ inputs.dockerfile }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           cache-from: type=gha