fix(docker): Alpine apk 镜像源 403 时自动回退阿里云/官方

- 新增 scripts/setup-alpine-mirrors.sh 探测可用镜像
- 移除硬编码清华源，runtime 固定 alpine:3.20 避免 latest 漂移

backend/Dockerfile

@@ -17,9 +17,10 @@ FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 
-# 使用国内 Alpine 镜像源加速 // Logan.Li
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
-RUN apk add --no-cache git ca-certificates tzdata
+# Alpine 镜像源探测（清华 403 时自动回退）// Logan.Li
+COPY scripts/setup-alpine-mirrors.sh /tmp/setup-alpine-mirrors.sh
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
+    apk add --no-cache git ca-certificates tzdata
 
 ENV TZ=Asia/Shanghai
 ENV GOPROXY=https://goproxy.cn,direct
@@ -80,20 +81,14 @@ FROM alpine:3.20
 ARG TARGETARCH
 ARG KUBECTL_VERSION=v1.32.2
 
-# 使用国内 Alpine 镜像源加速 // Logan.Li
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
-
 # 安装运行时依赖（核心最小集，重型工具改为懒加载）// Logan.Li
-# bash=kubectl交互终端, curl=健康检查, git=流水线代码拉取, docker-cli=镜像构建推送
-# kubectl 按 TARGETARCH 下载（linux/amd64|arm64）// Logan.Li
-RUN --mount=type=cache,target=/var/cache/apk \
-    apk add ca-certificates tzdata bash curl git docker-cli docker-cli-buildx
-
-COPY scripts/install-kubectl.sh /tmp/install-kubectl.sh
-RUN chmod +x /tmp/install-kubectl.sh && \
+COPY scripts/setup-alpine-mirrors.sh scripts/install-kubectl.sh /tmp/
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
+    apk add --no-cache ca-certificates tzdata bash curl git docker-cli docker-cli-buildx && \
+    chmod +x /tmp/install-kubectl.sh && \
     TARGET_OS=linux TARGET_ARCH="${TARGETARCH}" KUBECTL_VERSION="${KUBECTL_VERSION}" \
     /tmp/install-kubectl.sh /usr/local/bin/kubectl && \
-    rm -f /tmp/install-kubectl.sh
+    rm -f /tmp/setup-alpine-mirrors.sh /tmp/install-kubectl.sh
 
 # npm 淘宝镜像加速（node 懒加载后生效）
 RUN npm config set registry https://registry.npmmirror.com 2>/dev/null || true