build: make Go image build resilient to registry mirror failures

backend/Dockerfile

@@ -1,8 +1,20 @@
 # syntax=docker/dockerfile:1
 # Build context: the repository backend/ directory.
 #   docker build -f backend/Dockerfile -t REGISTRY/PROJECT/zhinian-go-api:TAG backend/
+#
+# GOLANG_IMAGE and RUNTIME_IMAGE are overridable for build environments whose
+# registry mirror cannot serve the default docker.io images:
+#   docker build -f backend/Dockerfile \
+#     --build-arg GOLANG_IMAGE=<working-mirror>/golang:1.21-alpine \
+#     --build-arg RUNTIME_IMAGE=<working-mirror>/alpine:3.20 \
+#     -t REGISTRY/PROJECT/zhinian-go-api:TAG backend/
+#
+# If no mirror can serve the golang image at all, use backend/Dockerfile.runtime
+# with a prebuilt static binary instead (see backend/README.md).
+ARG GOLANG_IMAGE=golang:1.21-alpine
+ARG RUNTIME_IMAGE=alpine:3.20
 
-FROM golang:1.21-alpine AS build
+FROM ${GOLANG_IMAGE} AS build
 WORKDIR /src
 ENV CGO_ENABLED=0 GOOS=linux
 COPY go.mod go.sum ./
@@ -10,7 +22,7 @@ RUN go mod download
 COPY . .
 RUN go build -trimpath -ldflags="-s -w" -o /out/zhinian-api ./cmd/zhinian-api
 
-FROM alpine:3.20
+FROM ${RUNTIME_IMAGE}
 RUN apk add --no-cache ca-certificates tzdata \
     && addgroup -S -g 10001 zhinian \
     && adduser -S -D -H -u 10001 -G zhinian zhinian \