fix(deploy): web image installs packages from npmmirror like the gate (BUG-1503)

Publish job 11273 and its rerun 11284 timed out fetching from
registry.npmjs.org (zwitch, then zustand) while every validate check passed.
The gate's own install already uses registry.npmmirror.com; the image's npm ci
now does too. The lock file pins versions and integrity hashes, so the
installed packages are unchanged. Approved by the product owner 2026-11-01.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DbBXoyeZrYn6ryNcSe5Y2Y

deploy/railway-web.Dockerfile

@@ -2,6 +2,10 @@ FROM swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-alpine A
 
 WORKDIR /app/frontend
 COPY frontend/package.json frontend/package-lock.json ./
+# Same registry as the quality gate's own install: the build host times out on
+# registry.npmjs.org (BUG-1503). The lock file pins every version and integrity
+# hash, so the installed packages are identical.
+ARG NPM_CONFIG_REGISTRY=https://registry.npmmirror.com
 RUN npm ci
 
 COPY frontend/src ./src

docs/BUG_HISTORY.md

@@ -20555,3 +20555,18 @@
 - 相关记录：BUG-177（同一开案流程，进行中案例的约束）。
 - 复发自：无
 - 修复版本：staging 集成分支 `codex/chart-base-layer-label`。
+
+## BUG-1503 | staging 打包镜像的 npm ci 连续超时，代码全过仍部署不了
+
+- 状态：resolved（改用国内镜像 + 回归断言；待 staging 发布复核）
+- 首次发现 / 最近更新：2026-11-01 / 2026-11-01（staging backend-quality-gate run 6349，提交 `9b1127c2`，publish 作业 11273 与重跑 11284）
+- 影响面：`deploy/railway-web.Dockerfile` 的 `RUN npm ci`（staging 与正式环境共用的网页镜像）。validate 作业全部通过（前端 5409/5409、lint 0 错误、Python 门禁），只有 publish 打包失败，迁移和部署因此没有执行。
+- 现象：`npm error code ETIMEDOUT`，`network request to https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz failed`；重跑一次换成 `zustand-5.0.15.tgz` 同样超时。
+- 触发条件：构建机访问 registry.npmjs.org 不稳定时的任何镜像构建。10-30 那次（run 6074 / 6080）同一个 Dockerfile 构建成功，说明是间歇性网络问题。
+- 根因：门禁自己的 `npm ci` 早已通过 `NPM_CONFIG_REGISTRY: https://registry.npmmirror.com` 走国内镜像，镜像构建的 `npm ci` 却没有设，仍连官方源。
+- 修复：Dockerfile 在 `npm ci` 前加 `ARG NPM_CONFIG_REGISTRY=https://registry.npmmirror.com`。锁文件固定了每个包的版本和完整性哈希，npm 会把锁文件里的官方源地址换成配置的源，装出来的内容不变。产品负责人 2026-11-01 同意改用国内镜像。
+- 验证：`frontend/tests/staging-backend-workflows.test.ts` 的「railway web image uses Next standalone runtime output」新增断言；`tests/test_railway_deployment.py` 通过。真正的验证是下一次 staging publish 打包成功。
+- 防复发：上述断言锁住镜像构建与门禁使用同一个镜像源。
+- 相关记录：BUG-149（门禁里 npm ci 没有安装期限）。
+- 复发自：无
+- 修复版本：staging 集成分支 `codex/chart-base-layer-label`。

frontend/tests/staging-backend-workflows.test.ts

@@ -175,6 +175,8 @@ test("railway web image uses Next standalone runtime output", () => {
     /ENV NEXT_DEPLOYMENT_ID=\$\{NEXT_DEPLOYMENT_ID\}[\s\S]*RUN npm run build/,
   );
   assert.match(dockerfile, /RUN npm run build\n/);
+  // BUG-1503: the image's own npm ci uses the same mirror as the gate install; registry.npmjs.org timed out twice.
+  assert.match(dockerfile, /ARG NPM_CONFIG_REGISTRY=https:\/\/registry\.npmmirror\.com\nRUN npm ci\n/);
   assert.doesNotMatch(dockerfile, /npm prune --omit=dev/);
   assert.match(dockerfile, /COPY --from=build \/app\/frontend\/\.next\/standalone \/app/);
   assert.match(dockerfile, /COPY --from=build \/app\/frontend\/\.next\/static \/app\/frontend\/\.next\/static/);