feat(build): 全面优化打包流程，Docker 镜像自动发布到 GHCR

Docker 优化：
- Dockerfile 层缓存（requirements/lockfile 先复制再安装）
- ARG 可配置镜像源，国际用户可覆盖为默认源
- 前端 Dockerfile 改用 corepack + frozen-lockfile
- 精简 .dockerignore，排除 .git 和 Tauri 构建产物

CI/CD 优化：
- docker-build 自动推送到 GHCR，支持 amd64/arm64 双架构
- 桌面端 CI 增加 pip/pnpm/cargo 缓存，升级 actions 版本
- Python 版本对齐为 3.11，增加 Linux 构建矩阵
- build.sh 加 -y 覆盖标志

文档更新：
- README Docker 部署简化为 docker pull + docker run

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile.complete

@@ -1,41 +1,56 @@
 # === 阶段1：构建 Backend ===
 FROM python:3.11-slim AS backend-builder
 
+ARG APT_MIRROR=mirrors.tuna.tsinghua.edu.cn
+ARG PIP_INDEX=https://pypi.tuna.tsinghua.edu.cn/simple
+
 RUN rm -f /etc/apt/sources.list && \
     rm -rf /etc/apt/sources.list.d/* && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm main contrib non-free non-free-firmware" > /etc/apt/sources.list && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm-updates main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian bookworm main contrib non-free non-free-firmware" > /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian bookworm-updates main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian-security bookworm-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
     apt-get update && \
-    apt-get install -y ffmpeg && \
+    apt-get install -y --no-install-recommends ffmpeg && \
     rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/usr/bin:${PATH}"
 ENV HF_ENDPOINT=https://hf-mirror.com
 
 WORKDIR /tmp/backend
+
+# 先复制 requirements.txt 利用层缓存
+COPY ./backend/requirements.txt /tmp/backend/requirements.txt
+RUN pip install --no-cache-dir -i ${PIP_INDEX} -r requirements.txt
+
 COPY ./backend /tmp/backend
-RUN pip install --no-cache-dir -i https://pypi.tuna.tsinghua.edu.cn/simple -r requirements.txt
 
 # === 阶段2：构建 Frontend ===
 FROM node:18-alpine AS frontend-builder
 
-RUN npm install -g pnpm
+RUN corepack enable && corepack prepare pnpm@latest --activate
+
 WORKDIR /tmp/frontend
+
+# 先复制 lockfile 利用依赖层缓存
+COPY ./BillNote_frontend/package.json ./BillNote_frontend/pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
+
 COPY ./BillNote_frontend /tmp/frontend
-RUN pnpm install && pnpm run build
+RUN pnpm run build
 
 # === 阶段3：完整应用镜像 ===
 FROM python:3.11-slim
 
+ARG APT_MIRROR=mirrors.tuna.tsinghua.edu.cn
+
 # 安装必要的运行时依赖
 RUN rm -f /etc/apt/sources.list && \
     rm -rf /etc/apt/sources.list.d/* && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm main contrib non-free non-free-firmware" > /etc/apt/sources.list && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian bookworm-updates main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
-    echo "deb https://mirrors.tuna.tsinghua.edu.cn/debian-security bookworm-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian bookworm main contrib non-free non-free-firmware" > /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian bookworm-updates main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
+    echo "deb https://${APT_MIRROR}/debian-security bookworm-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list && \
     apt-get update && \
-    apt-get install -y ffmpeg nginx supervisor procps && \
+    apt-get install -y --no-install-recommends ffmpeg nginx supervisor procps && \
     rm -rf /var/lib/apt/lists/*
 
 ENV PATH="/usr/bin:${PATH}"