ci(build): pull Docker Hub base images via Nexus mirror + kargadan GOPROXY

Docker Hub blocks Iran (403) on the BUILD base images too (golang/alpine/busybox/
node) once they fall out of cache. Prefix every Docker Hub FROM/COPY --from with
mirror.soroushasadi.com/ (MCR dotnet images are reachable, left as-is). Go builders
also set GOPROXY=mirror.kargadan.ir/repository/go-group/ + GOSUMDB=off so any module/
toolchain fetch avoids the geo-blocked proxy.golang.org.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/studio/Dockerfile

@@ -4,7 +4,7 @@ EXPOSE 8080
 # The .NET base image ships neither wget nor curl, which the container healthcheck needs.
 # Copy a single static busybox binary named `wget` (busybox dispatches on argv[0]).
 # This stays fully offline — no apt/network — matching the vendored Go builds.
-COPY --from=busybox:1.36 /bin/busybox /usr/bin/wget
+COPY --from=mirror.soroushasadi.com/busybox:1.36 /bin/busybox /usr/bin/wget
 
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 WORKDIR /src