fix: pull node:20-alpine from Arvan/ECR when Docker Hub is blocked

.gitea/workflows/registry-build-deploy.yml

@@ -17,6 +17,8 @@
 #   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
 #   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
 #   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
+#   NODE_IMAGE_SOURCE    extra base-image ref(s), comma-separated, tried before built-in mirrors
+#                        e.g. docker.arvancloud.ir/library/node:20-alpine
 #
 # Same Windows PC runs Gitea + runner + deploy:
 #   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
@@ -84,11 +86,13 @@ jobs:
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
-      - name: Resolve node:20-alpine (Gitea mirror, then local, then Hub)
+      - name: Resolve node:20-alpine (Gitea, then mirrors, Hub last)
         run: |
           $ErrorActionPreference = 'Stop'
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
-          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix
+          $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
+          if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
+          powershell -NoProfile -ExecutionPolicy Bypass -File .\infrastructure\scripts\ci-resolve-node-image.ps1 -RegistryPrefix $prefix -ExtraSources $extra
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend