fix(cd): avoid unauthorized web base mirror

.gitea/workflows/cd.yaml

@@ -1623,9 +1623,12 @@ jobs:
             return "$rc"
           }
 
+          # 2026-07-03 Codex: run #4610 proved the Harbor DockerHub proxy
+          # cache path returned 401 for node:20-alpine. Keep the public tag
+          # until proxy-cache pull auth has a deploy-log receipt.
           run_docker_step web_build "${DOCKER_WEB_BUILD_TIMEOUT_SECONDS:-1500}" \
             docker build -f apps/web/Dockerfile \
-            --build-arg NODE_BASE_IMAGE=${{ env.HARBOR }}/dockerhub/library/node:20-alpine \
+            --build-arg NODE_BASE_IMAGE=node:20-alpine \
             --build-arg NEXT_PUBLIC_API_URL=https://awoooi.wooo.work \
             --build-arg CACHE_BUST=${{ github.sha }} \
             --build-arg BUILDKIT_INLINE_CACHE=1 \