ci: pull node base image from Harbor instead of docker.io

Kaniko builds failed with context deadline exceeded pulling node:24-alpine
from index.docker.io through the egress proxy. Seed node:24-alpine into
abrban/ and pass BASE_IMAGE build-arg so builds use the internal registry.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -103,15 +103,15 @@ jobs:
                 containers:
                   - name: kaniko
                     image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
-                    # Kaniko pulls base images (node:24-alpine) straight from
-                    # docker.io — needs the egress proxy. NO_PROXY keeps the
-                    # push to harbor-registry direct.
+                    # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids
+                    # flaky direct pulls from docker.io through the egress proxy.
                     envFrom:
                       - secretRef:
                           name: registry-egress-proxy
                     args:
                       - --dockerfile=/workspace/backend/Dockerfile
                       - --context=dir:///workspace/backend
+                      - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine
                       - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-backend:${IMAGE_TAG}
                       - --insecure
                       - --skip-tls-verify
@@ -172,6 +172,7 @@ jobs:
                     args:
                       - --dockerfile=/workspace/frontend/Dockerfile
                       - --context=dir:///workspace/frontend
+                      - --build-arg=BASE_IMAGE=${PULL_REGISTRY}/${PROJECT}/node:24-alpine
                       - --build-arg=NEXT_PUBLIC_API_URL=https://api.abrban.com
                       - --destination=${PUSH_REGISTRY}/${PROJECT}/cloudhost-frontend:${IMAGE_TAG}
                       - --insecure