fix(deploy): keep BuildKit cache and use Huawei mirrors for API images

Gitea run 2828 validated, then publish hit the 60-minute deadline while
Aliyun apt/pip crawled at about 22 kB/s after a 72h cache prune on a
runner with 677 GiB free. Skip BuildKit prune when disk is above the
minimum, split API apt/pip layers, and point apt/pypi at Huawei Cloud.

deploy/railway-api.Dockerfile

@@ -2,15 +2,18 @@ FROM swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
-    PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ \
+    PIP_INDEX_URL=https://mirrors.huaweicloud.com/repository/pypi/simple/ \
     PIP_DEFAULT_TIMEOUT=60
 WORKDIR /app
 
 COPY requirements.txt deploy/patch_vedastro_update_check.py ./
-RUN sed -i 's|http://deb.debian.org|https://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources \
+# Apt packages are their own layer so a later pip timeout can reuse them.
+# Huawei mirrors share the SWR path already used for the base image; Aliyun
+# debian/pypi at ~22 kB/s cannot finish this RUN inside the 60-minute publish job.
+RUN sed -i 's|http://deb.debian.org|https://mirrors.huaweicloud.com|g' /etc/apt/sources.list.d/debian.sources \
     && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 update \
-    && apt-get install -y --no-install-recommends build-essential nodejs \
-    && python -m pip install -r requirements.txt \
+    && apt-get install -y --no-install-recommends build-essential nodejs
+RUN python -m pip install -r requirements.txt \
     && python patch_vedastro_update_check.py \
     && apt-get purge -y --auto-remove build-essential \
     && rm -rf /var/lib/apt/lists/*

deploy/reclaim-runner-disk.sh

@@ -66,20 +66,26 @@ if [ -n "$STALE_IMAGES" ]; then
   printf '%s\n' "$STALE_IMAGES" | xargs -r docker image rm || true
 fi
 
-# BuildKit layer cache is what lets the publish job reuse the Dockerfile
-# `npm ci` layer instead of rebuilding it from scratch behind the mirror (a
-# 7-minute image build versus 47). `docker image prune --force` above removes
-# only dangling images; BuildKit cache records live in the builder store, not
-# in dangling images, so nothing before this point touches them. Reclaim them
-# in tiers: drop entries nobody has used for 72 hours, re-measure, and escalate
-# to `--all` only when the runner is still below the threshold.
-docker builder prune --force --filter until=72h
-
-TIERED_GIB="$(free_gib)"
-echo "docker root $DOCKER_ROOT has ${TIERED_GIB} GiB free after aged build-cache reclaim"
-if [ "$TIERED_GIB" -lt "$MINIMUM_FREE_GIB" ]; then
-  echo "still below ${MINIMUM_FREE_GIB} GiB; escalating to a full BuildKit cache prune"
-  docker builder prune --force --all
+# BuildKit layer cache is what lets the publish job reuse apt/pip/`npm ci`
+# layers instead of rebuilding behind a slow mirror (7-minute image builds
+# versus 47–60). `docker image prune --force` above removes only dangling
+# images; BuildKit cache lives in the builder store. Do not touch it while
+# the runner still has at least MINIMUM_FREE_GIB. Aged and full prunes are
+# reachable only after re-measuring and finding the disk actually short.
+CACHE_GIB="$(free_gib)"
+echo "docker root $DOCKER_ROOT has ${CACHE_GIB} GiB free before BuildKit reclaim"
+if [ "$CACHE_GIB" -lt "$MINIMUM_FREE_GIB" ]; then
+  echo "below ${MINIMUM_FREE_GIB} GiB; pruning BuildKit cache unused for 72h"
+  docker builder prune --force --filter until=72h
+  TIERED_GIB="$(free_gib)"
+  echo "docker root $DOCKER_ROOT has ${TIERED_GIB} GiB free after aged build-cache reclaim"
+  if [ "$TIERED_GIB" -lt "$MINIMUM_FREE_GIB" ]; then
+    echo "still below ${MINIMUM_FREE_GIB} GiB; escalating to a full BuildKit cache prune"
+    docker builder prune --force --all
+  fi
+else
+  echo "keeping BuildKit layer cache; ${CACHE_GIB} GiB free"
+  TIERED_GIB="$CACHE_GIB"
 fi
 
 AFTER_GIB="$(free_gib)"