fix: use Debian official HTTP mirrors in runtime stage (Tencent mirrors redirect to HTTPS which fails without ca-certificates on slim)

deploy/docker/backend.Dockerfile

@@ -76,11 +76,15 @@ WORKDIR /app
 # - python3: needed by venv (links to system libpython)
 # - tzdata: timezone data for TZ=Asia/Shanghai
 # - Chromium runtime libs: minimal set for headless Chromium on slim
+#
+# NOTE: We do NOT switch to Tencent mirrors here because:
+#   1. slim image has no ca-certificates pre-installed
+#   2. Tencent mirrors redirect HTTP → HTTPS, which fails without ca-certificates (chicken-and-egg)
+#   3. Debian official HTTP mirrors (deb.debian.org) work without TLS verification
+#   4. Apt packages are GPG-signed, so HTTP is safe
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
+    apt-get update \
-  && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
-  && apt-get update \
   && apt-get install -y --no-install-recommends \
        curl ca-certificates python3 tzdata \
        libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 \