fix: use BASE_IMAGE build args to pull through Harbor cache, avoid Docker Hub rate limits

Dockerfiles default to Docker Hub images (unchanged for external builds).
Woodpecker passes registry.celestium.life/dockerhub-cache/... via build args.

frontend/Dockerfile

@@ -1,5 +1,6 @@
 # Stage 1: Build
-FROM node:24-alpine AS build
+ARG BASE_IMAGE=node:24-alpine
+FROM ${BASE_IMAGE} AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -10,7 +11,8 @@ ARG VITE_RISK_ENGINE_URL=""
 RUN npm run build
 
 # Stage 2: Serve (unprivileged nginx, runs as uid 101, port 8080)
-FROM nginxinc/nginx-unprivileged:alpine
+ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:alpine
+FROM ${NGINX_IMAGE}
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 8080