fix: use BASE_REGISTRY arg to route all FROM pulls through Harbor cache

Default: docker.io (unchanged for external builds)
Woodpecker passes: registry.celestium.life/dockerhub-cache

docker/Dockerfile

@@ -1,5 +1,6 @@
-ARG BASE_IMAGE=python:3.12-slim
-FROM ${BASE_IMAGE}
+# Base image: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+ARG BASE_REGISTRY=docker.io
+FROM ${BASE_REGISTRY}/library/python:3.12-slim
 
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1