chore(260618-tg2): BuildKit pnpm-store cache mount in Dockerfile build

Add 'RUN --mount=type=cache,target=/pnpm-store' to all 3 pnpm install
stages (builder/pwa-builder/production) with --store-dir /pnpm-store, plus
the '# syntax=docker/dockerfile:1' directive. Set DOCKER_BUILDKIT=1 on the
publish build step so the legacy builder can't break on the mount syntax.
sharing=locked because builder and pwa-builder run in parallel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/publish.yml

@@ -88,6 +88,11 @@ jobs:
       # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
       # lockfile from the root context; building from apps/api/ would fail to find them.
       - name: Build production image
+        # DOCKER_BUILDKIT=1 is required: the Dockerfile uses `RUN --mount=type=cache`
+        # (BuildKit) to persist the pnpm store across builds. The legacy builder would
+        # fail on that syntax. BuildKit is default on Docker 23+, set explicitly for safety.
+        env:
+          DOCKER_BUILDKIT: '1'
         run: |
           set -euo pipefail
           docker build --target production \