Add egress proxy to user-app Kaniko build jobs.

Inject registry-egress-proxy into Kaniko and network init containers so npm/apk/composer/pip/git clone work on restricted egress clusters.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/build/build.service.spec.ts

@@ -137,4 +137,29 @@ describe('BuildService', () => {
       expect(dockerfile).toContain('dotnet publish "$CSPROJ"');
     });
   });
+
+  describe('egressProxyEnvFrom', () => {
+    it('returns secretRef when BUILD_EGRESS_PROXY_SECRET is set', () => {
+      const config = (service as any).configService as { get: jest.Mock };
+      config.get.mockImplementation((key: string) => {
+        if (key === 'build.egressProxySecret') return 'registry-egress-proxy';
+        return undefined;
+      });
+
+      expect((service as any).egressProxyEnvFrom()).toEqual([
+        { secretRef: { name: 'registry-egress-proxy' } },
+      ]);
+    });
+
+    it('returns undefined when egress proxy is disabled', () => {
+      const config = (service as any).configService as { get: jest.Mock };
+      config.get.mockImplementation((key: string) => {
+        if (key === 'build.egressProxySecret') return '';
+        return undefined;
+      });
+
+      expect((service as any).egressProxyEnvFrom()).toBeUndefined();
+      expect((service as any).withEgressProxy({ name: 'kaniko' })).toEqual({ name: 'kaniko' });
+    });
+  });
 });