Task: Make Go image build resilient to mirror failures

Identity

Fix the CI image build failure where the build machine's registry accelerator (mirror.aliyuncs.com) returned 500 on a golang:1.21-alpine blob: make the base images overridable and add a golang-image-free build path.

Keep the standard multi-stage build as the default; no behavioral change for healthy registries.
The runtime image must stay non-root, root-filesystem-read-only compatible, and identical across both build paths.

backend/Dockerfile: added GOLANG_IMAGE and RUNTIME_IMAGE ARGs so a working mirror can be supplied via --build-arg without editing the file.
Added backend/Dockerfile.runtime: alpine-only image that copies a prebuilt static zhinian-api.linux binary, for build environments that cannot pull the golang builder image at all.
Documented all three build paths (standard, mirror override, prebuilt binary) in backend/README.md and docs/DEPLOYMENT.md.

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o zhinian-api.linux ./cmd/zhinian-api succeeds on this machine: 12.3 MB statically linked stripped ELF x86-64, confirming the prebuilt-binary path is usable.
Docker image assembly itself must run on a machine with Docker; both Dockerfiles follow the same runtime stage as the already-merged image definition.

On the CI machine, either switch the registry accelerator in /etc/docker/daemon.json or use the prebuilt-binary path.
Re-run the failing Gitea build to confirm.