fix: use BASE_REGISTRY arg to route all FROM pulls through Harbor cache

Default: docker.io (unchanged for external builds)
Woodpecker passes: registry.celestium.life/dockerhub-cache

frontend/Dockerfile

@@ -1,6 +1,7 @@
 # Stage 1: Build
-ARG BASE_IMAGE=node:24-alpine
-FROM ${BASE_IMAGE} AS build
+# Base images: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+ARG BASE_REGISTRY=docker.io
+FROM ${BASE_REGISTRY}/library/node:24-alpine AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -11,8 +12,8 @@ ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
 # Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
-ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:alpine
-FROM ${NGINX_IMAGE}
+ARG BASE_REGISTRY=docker.io
+FROM ${BASE_REGISTRY}/nginxinc/nginx-unprivileged:alpine
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 8080