build: add self-contained alpine-only Go image build

backend/Dockerfile.alpine

@@ -0,0 +1,31 @@
+# Self-contained one-command build: only the alpine base image is pulled —
+# no golang builder image, no external dockerfile frontend. The Go toolchain
+# comes from Alpine's package repositories (mirrored to Aliyun), and module
+# downloads use goproxy.cn, so the whole build works on China CI networks.
+#
+#   docker build -f backend/Dockerfile.alpine \
+#     -t REGISTRY/PROJECT/zhinian-go-api:TAG backend/
+FROM alpine:3.20 AS build
+RUN sed -i 's#https\?://dl-cdn.alpinelinux.org#https://mirrors.aliyun.com#' /etc/apk/repositories \
+    && apk add --no-cache go
+WORKDIR /src
+ENV CGO_ENABLED=0 \
+    GOOS=linux \
+    GOPROXY=https://goproxy.cn,direct \
+    GOSUMDB=sum.golang.google.cn
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN go build -trimpath -ldflags="-s -w" -o /out/zhinian-api ./cmd/zhinian-api
+
+FROM alpine:3.20
+RUN sed -i 's#https\?://dl-cdn.alpinelinux.org#https://mirrors.aliyun.com#' /etc/apk/repositories \
+    && apk add --no-cache ca-certificates tzdata \
+    && addgroup -S -g 10001 zhinian \
+    && adduser -S -D -H -u 10001 -G zhinian zhinian \
+    && mkdir -p /var/lib/zhinian \
+    && chown -R zhinian:zhinian /var/lib/zhinian
+COPY --from=build /out/zhinian-api /usr/local/bin/zhinian-api
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["zhinian-api"]