feat: make DuckDB support opt-in

[skgbafa]

Summary

• move DuckDB and Arrow dependencies behind a tinycloud-core/duckdb feature
• add a tinycloud-node duckdb feature and gate DuckDB service setup, /info advertisement, invoke handling, and hook subscription validation
• keep default release/Phala dstack deployments DuckDB-free; manual Docker workflow dispatch can opt into DuckDB with include_duckdb, using -duckdb image tag suffixes
• fix Dockerfile feature passing so multiple features like dstack duckdb are passed as one Cargo feature value

Validation

• cargo check -p tinycloud-node --features dstack
• cargo check -p tinycloud-node --features "dstack duckdb"
• cargo tree -p tinycloud-node --features dstack | rg -n "(^| )duckdb|(^| )arrow" || true produced no matches
• cargo clippy -p tinycloud-node -- -D warnings
• cargo clippy -p tinycloud-node --features "dstack duckdb" -- -D warnings
• cargo test -p tinycloud-node --lib
• cargo test -p tinycloud-node --lib --features "dstack duckdb"
• cargo test -p tinycloud-core --features duckdb duckdb::
• go run github.com/rhysd/actionlint/cmd/actionlint@latest -oneline .github/workflows/docker.yml

Note: I did not run a full Docker image build locally because it recreates the long compile this PR is removing from the default path.