fix(deploy): keep BuildKit cache and use Huawei mirrors for API images

Gitea run 2828 validated, then publish hit the 60-minute deadline while
Aliyun apt/pip crawled at about 22 kB/s after a 72h cache prune on a
runner with 677 GiB free. Skip BuildKit prune when disk is above the
minimum, split API apt/pip layers, and point apt/pypi at Huawei Cloud.

frontend/tests/staging-backend-workflows.test.ts

@@ -406,6 +406,7 @@ test("both gate jobs reclaim runner disk before they need it, and only unheld re
   assert.match(script, /docker image prune --force\n/);
   assert.match(script, /docker builder prune --force --filter until=72h/);
   assert.match(script, /docker builder prune --force --all/);
+  assert.match(script, /keeping BuildKit layer cache/);
   assert.match(script, /grep -v -F -e "api-\$KEEP_TAG_SHA" -e "web-\$KEEP_TAG_SHA"/);
   assert.match(script, /PostgreSQL fixtures and image builds need at least \$\{MINIMUM_FREE_GIB\} GiB/);
   // A gate that silently proceeds on a full disk fails 23 database tests instead
@@ -1307,21 +1308,32 @@ test("runner disk reclaim keeps BuildKit cache unless the runner is actually sho
 
   // Unconditionally pruning the whole BuildKit store made every publish job
   // rebuild the Dockerfile `npm ci` layer from scratch (47-minute image builds).
-  // Aged cache goes first; `--all` is reachable only after re-measuring and
-  // finding the runner still below MINIMUM_FREE_GIB.
+  // Run 2828 then showed the remaining 72h prune still drops that cache when
+  // disk is plentiful, forcing a 22 kB/s apt/pip rebuild that hits the
+  // 60-minute publish timeout. Aged and `--all` prunes run only after the
+  // post-image-prune measurement is below MINIMUM_FREE_GIB.
   assert.doesNotMatch(script, /^docker builder prune --force --all$/m);
+  assert.doesNotMatch(script, /^docker builder prune --force --filter until=72h$/m);
   assert.equal((script.match(/docker builder prune --force --all/g) ?? []).length, 1);
+  assert.equal((script.match(/docker builder prune --force --filter until=72h/g) ?? []).length, 1);
   assertOrder(script, [
     "docker image prune --force",
+    'CACHE_GIB="$(free_gib)"',
+    'if [ "$CACHE_GIB" -lt "$MINIMUM_FREE_GIB" ]; then',
     "docker builder prune --force --filter until=72h",
     'TIERED_GIB="$(free_gib)"',
     'if [ "$TIERED_GIB" -lt "$MINIMUM_FREE_GIB" ]; then',
     "docker builder prune --force --all",
+    "keeping BuildKit layer cache",
     'AFTER_GIB="$(free_gib)"',
   ]);
   assert.match(
     script,
-    /if \[ "\$TIERED_GIB" -lt "\$MINIMUM_FREE_GIB" \]; then\n\s+echo[^\n]+\n\s+docker builder prune --force --all\nfi\n/,
+    /if \[ "\$CACHE_GIB" -lt "\$MINIMUM_FREE_GIB" \]; then\n\s+echo[^\n]+\n\s+docker builder prune --force --filter until=72h/,
+  );
+  assert.match(
+    script,
+    /if \[ "\$TIERED_GIB" -lt "\$MINIMUM_FREE_GIB" \]; then\n\s+echo[^\n]+\n\s+docker builder prune --force --all\n\s+fi\n/,
   );
   // The final threshold check still fails the job instead of silently proceeding.
   assert.match(script, /if \[ "\$AFTER_GIB" -lt "\$MINIMUM_FREE_GIB" \]; then\n\s+echo[^\n]+\n\s+exit 1/);