ci: consolidate Nexus deployment and provenance

backend/Dockerfile

@@ -6,6 +6,12 @@ COPY . .
 RUN dotnet publish -c Release -o /app/publish
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
+ARG NEXUS_VERSION=dev
+ARG NEXUS_GIT_SHA=unknown
+LABEL org.opencontainers.image.title="Nexus API" \
+      org.opencontainers.image.source="https://git.noveria.net/bao/nexus" \
+      org.opencontainers.image.version="${NEXUS_VERSION}" \
+      org.opencontainers.image.revision="${NEXUS_GIT_SHA}"
 WORKDIR /app
 COPY --from=build /app/publish .
 RUN apk add --no-cache curl