将构建镜像源切换为阿里云并修复 apt 证书引导失败

默认 DEBIAN/ALPINE 源改为 mirrors.aliyun.com，compose 支持通过环境变量覆盖；构建时先装 ca-certificates，避免 slim 镜像换源后 HTTPS 校验失败。

deploy/docker/backend-dev.Dockerfile

@@ -1,7 +1,8 @@
 # 快手轻量开发镜像：只保留 Node 运行时和基础工具。
 FROM docker.m.daocloud.io/library/node:22-bookworm
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,13 +11,17 @@ ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata \
+       curl tzdata \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone