fix(ci): stop pulling Alpine packages from the geo-blocked CDN

The CI server can't reach dl-cdn.alpinelinux.org (TLS error) — only the Nexus
mirror is reachable, and it proxies Docker images, not apk packages.

- frontend: drop `apk add libc6-compat` (vestigial Next.js-template line; the
  deps stage only runs `npm ci` and the build/runtime stages never had it).
- 5 Go services (file/gateway/notification/payment/render): replace
  `apk add ca-certificates tzdata` with copying ca-certificates.crt from the
  golang builder stage + embedding tzdata via `go build -tags timetzdata`.
  No more apk -> no dependency on the Alpine CDN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -1,6 +1,9 @@
 # ── Stage 1: install dependencies ────────────────────────────────────────────
 FROM mirror.soroushasadi.com/node:20-alpine AS deps
-RUN apk add --no-cache libc6-compat
+# NOTE: do NOT `apk add libc6-compat` here — the deps stage only runs `npm ci`
+# (which doesn't need it) and the build/runtime stages omit it anyway. Pulling it
+# reaches Alpine's public CDN (dl-cdn.alpinelinux.org), which is unreachable from
+# the CI server (only the Nexus mirror is) and fails the whole build.
 WORKDIR /app
 
 COPY package.json package-lock.json* ./