fix: make backend Docker builds reproducible

backend/Dockerfile

@@ -1,28 +1,27 @@
-FROM node:20-alpine
+FROM node:20-alpine AS dependencies
 
 WORKDIR /app
 
-# 安装编译工具和健康检查所需的 wget
-RUN apk add --no-cache python3 make g++ wget
+# 原生依赖使用镜像内置 Node headers，避免构建时依赖外部 headers 下载站点。
+RUN apk add --no-cache python3 make g++
+ENV npm_config_nodedir=/usr/local
 
-# 复制 package 文件
 COPY package*.json ./
-
-# 严格按锁文件安装生产依赖
 RUN npm ci --omit=dev
 
-# 复制应用代码
+FROM node:20-alpine AS runtime
+
+WORKDIR /app
+
+RUN apk add --no-cache libstdc++ wget
+COPY --from=dependencies /app/node_modules ./node_modules
 COPY . .
 
-# 创建数据目录
 RUN mkdir -p /app/data /app/storage
 
-# 暴露端口
 EXPOSE 40001
 
-# 健康检查
 HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
     CMD wget --spider -q http://localhost:40001/api/health || exit 1
 
-# 启动应用
 CMD ["node", "server.js"]

backend/tests/architecture-tests.js

@@ -91,6 +91,11 @@ test('Docker 构建上下文排除依赖、环境配置和运行时数据', () =
   for (const requiredEntry of ['node_modules', '.env', 'data/*', 'storage/*']) {
     assert.ok(dockerIgnore.split(/\r?\n/).includes(requiredEntry), requiredEntry);
   }
+
+  const dockerfile = fs.readFileSync(path.join(projectRoot, 'backend', 'Dockerfile'), 'utf8');
+  assert.ok(dockerfile.includes('AS dependencies'));
+  assert.ok(dockerfile.includes('AS runtime'));
+  assert.ok(dockerfile.includes('npm_config_nodedir=/usr/local'));
 });
 
 test('install.sh 生成的 Nginx server 块花括号平衡', () => {