build: package standalone DWH authentication service

docker/dwh-auth.Dockerfile

@@ -0,0 +1,18 @@
+FROM golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651 AS build
+
+WORKDIR /src/tools/dwh-auth
+COPY tools/dwh-auth/go.mod ./
+COPY tools/dwh-auth/ ./
+
+RUN set -eux; \
+    CGO_ENABLED=0 go test ./... -count=1; \
+    mkdir -p /out; \
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+      go build -trimpath -ldflags='-s -w' -o /out/dwh-auth-linux-amd64 ./cmd/dwh-auth; \
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+      go build -trimpath -ldflags='-s -w' -o /out/dwh-auth-linux-arm64 ./cmd/dwh-auth; \
+    test -s /out/dwh-auth-linux-amd64; \
+    test -s /out/dwh-auth-linux-arm64
+
+FROM scratch AS export
+COPY --from=build /out/ /