Adds admin to docker-compose.site.yml and a fourth Go image to the build
workflow, both following the conventions the other services already use.
LICENSE_SIGNING_KEY now appears in exactly one service in exactly one
compose file. It must never be added to server, and the self-hosted
docker-compose.yml still does not mention admin at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Also pins the explicit shared require in both go.mod files. `go mod tidy`
in workspace mode drops it, which breaks the Docker build where no
workspace exists.