ci: add PR build job so dependabot bumps get compile/test verification

Adds a cargo build+test job triggered on pull_request, and gates the
docker push job behind it (release-only). Previously the workflow only
ran on release events, so no Rust checks ran against any PRs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nihaopaul

.github/workflows/rust.yml

@@ -3,13 +3,32 @@ name: Rust Build CI
 on:
   release:
     types: [published]
+  pull_request:
+    branches: [main]
 
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  build:
+    name: build and test
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: check repository
+        uses: actions/checkout@v4
+
+      - name: build
+        run: cargo build --release
+
+      - name: test
+        run: cargo test
+
   docker:
     name: push docker image to hub
+    if: github.event_name == 'release'
+    needs: build
     permissions:
       contents: read
     runs-on: ubuntu-latest
@@ -37,4 +56,3 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
-          # tags: nihaopaul/forward-auth:latest