refactor(build): 切换到 musl 交叉编译 + distroless 镜像方案

- docker-publish.yml: 改为 cross 交叉编译 amd64/arm64 musl 静态二进制,
  前端在 CI 独立构建, buildx 组装多架构镜像
- Dockerfile.app: 从 139 行容器内编译简化为 24 行纯 COPY 打包
- Dockerfile.app.local: 移除 jemalloc 动态链接 (LD_PRELOAD/libjemalloc2)
- aether-gateway: 引入 tikv-jemallocator 静态链接 jemalloc

.github/workflows/docker-publish.yml

@@ -5,46 +5,113 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   REGISTRY: ghcr.io
-  APP_IMAGE_NAME: fawney19/aether
-  GITHUB_REPO: fawney19/Aether
+  GHCR_IMAGE: fawney19/aether
+  DOCKERHUB_IMAGE: fawney19/aether
 
 jobs:
-  download-hub:
+  frontend:
+    name: Build frontend
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      hub_tag: ${{ steps.hub-tag.outputs.tag }}
-    steps:
-      - name: Get latest hub release tag
-        id: hub-tag
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG=$(gh release list --repo "${{ env.GITHUB_REPO }}" --limit 50 --json tagName,isDraft,isPrerelease \
-            --jq '[.[] | select(.tagName | startswith("hub-v")) | select(.isDraft == false and .isPrerelease == false)] | .[0].tagName')
-          if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
-            echo "No hub release found"
-            exit 1
-          fi
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-          echo "Hub release tag: $TAG"
-
-  build-app:
-    needs: [download-hub]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install & build
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: frontend-dist
+          path: frontend/dist/
+          if-no-files-found: error
+          retention-days: 1
+
+  build:
+    name: Build ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - name: linux-amd64
+            target: x86_64-unknown-linux-musl
+            arch: amd64
+          - name: linux-arm64
+            target: aarch64-unknown-linux-musl
+            arch: arm64
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: release-${{ matrix.target }}
+          workspaces: . -> target
+
+      - name: Install cross
+        uses: taiki-e/install-action@cross
+
+      - name: Build
+        env:
+          CARGO_TERM_COLOR: always
+        run: cross build --release --locked -p aether-gateway --target ${{ matrix.target }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: aether-gateway-${{ matrix.arch }}
+          path: target/${{ matrix.target }}/release/aether-gateway
+          if-no-files-found: error
+          retention-days: 1
+
+  docker:
+    name: Docker multi-arch
+    needs: [frontend, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v5
+        with:
+          path: artifacts
+
+      - name: Prepare dist layout
+        run: |
+          mkdir -p dist
+          cp artifacts/aether-gateway-amd64/aether-gateway dist/aether-gateway-amd64
+          cp artifacts/aether-gateway-arm64/aether-gateway dist/aether-gateway-arm64
+          chmod +x dist/aether-gateway-amd64 dist/aether-gateway-arm64
+          cp -r artifacts/frontend-dist dist/frontend
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to Container Registry
+      - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -57,13 +124,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Extract metadata for app image
+      - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}
-            docker.io/fawney19/aether
+            ${{ env.REGISTRY }}/${{ env.GHCR_IMAGE }}
+            docker.io/${{ env.DOCKERHUB_IMAGE }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
@@ -73,68 +140,12 @@ jobs:
           flavor: |
             latest=auto
 
-      - name: Extract version from tag
-        id: version
-        run: |
-          VERSION="${GITHUB_REF#refs/tags/v}"
-          if [ "$VERSION" = "$GITHUB_REF" ]; then
-            VERSION=$(git describe --tags --always | sed 's/^v//')
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Extracted version: $VERSION"
-
-      - name: Resolve hub release for build args
-        run: |
-          echo "Hub release tag: ${{ needs.download-hub.outputs.hub_tag }}"
-
-      - name: Build and push app image (amd64)
-        id: build-amd64
+      - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile.app
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=app-amd64
-          cache-to: type=gha,mode=min,scope=app-amd64
-          build-args: |
-            HUB_RELEASE_REPO=${{ env.GITHUB_REPO }}
-            HUB_TAG=${{ needs.download-hub.outputs.hub_tag }}
-          platforms: linux/amd64
-          outputs: type=image,"name=${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }},docker.io/fawney19/aether",push-by-digest=true,name-canonical=true,push=true
-
-      - name: Build and push app image (arm64)
-        id: build-arm64
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile.app
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=app-arm64
-          cache-to: type=gha,mode=min,scope=app-arm64
-          build-args: |
-            HUB_RELEASE_REPO=${{ env.GITHUB_REPO }}
-            HUB_TAG=${{ needs.download-hub.outputs.hub_tag }}
-          platforms: linux/arm64
-          outputs: type=image,"name=${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }},docker.io/fawney19/aether",push-by-digest=true,name-canonical=true,push=true
-
-      - name: Create multi-arch manifest and push
-        run: |
-          AMD64_DIGEST="${{ steps.build-amd64.outputs.digest }}"
-          ARM64_DIGEST="${{ steps.build-arm64.outputs.digest }}"
-          echo "amd64 digest: $AMD64_DIGEST"
-          echo "arm64 digest: $ARM64_DIGEST"
-
-          TAGS=$(echo "${{ steps.meta.outputs.tags }}" | tr '\n' ' ')
-          for FULL_TAG in $TAGS; do
-            if [[ "$FULL_TAG" == ghcr.io/* ]]; then
-              REPO="${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}"
-            elif [[ "$FULL_TAG" == docker.io/* ]]; then
-              REPO="docker.io/fawney19/aether"
-            else
-              continue
-            fi
-            echo "Creating manifest for $FULL_TAG"
-            docker buildx imagetools create -t "$FULL_TAG" \
-              "$REPO@$AMD64_DIGEST" \
-              "$REPO@$ARM64_DIGEST"
-          done
+          platforms: linux/amd64,linux/arm64