fix: use BASE_REGISTRY arg to route all FROM pulls through Harbor cache

Default: docker.io (unchanged for external builds)
Woodpecker passes: registry.celestium.life/dockerhub-cache

docker/Dockerfile

@@ -1,5 +1,6 @@
-ARG BASE_IMAGE=python:3.12-slim
-FROM ${BASE_IMAGE}
+# Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+ARG BASE_REGISTRY=docker.io
+FROM ${BASE_REGISTRY}/library/python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1

docker/Dockerfile.superset

@@ -1,6 +1,7 @@
 # Custom Superset image with Trino, PostgreSQL, and Redis drivers
-ARG BASE_IMAGE=apache/superset:latest
-FROM ${BASE_IMAGE}
+# Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+ARG BASE_REGISTRY=docker.io
+FROM ${BASE_REGISTRY}/apache/superset:latest
 
 USER root
 RUN /app/docker/pip-install.sh --no-cache trino[sqlalchemy] psycopg2-binary redis