perf(ci): Build-Zeit senken – BuildKit-Cache-Mounts + mode=min

- Dockerfile: --mount=type=cache für /root/.npm (npm ci) und /app/.next/cache
  (inkrementeller next build statt jedes Mal von Null)
- deploy.yml: cache-to mode=max -> mode=min (spart auf dem NAS den ~12 Min
  Cache-Export, der bisher grösster Einzelposten war)
- provenance/sbom aus (weniger Attestation-Export)
- ENV-Legacy-Warnungen behoben (ENV key=value)
- Version 1.4.5

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,10 +1,12 @@
+# syntax=docker/dockerfile:1
 # Stage 1: Dependencies
 FROM node:20-alpine AS deps
 RUN apk add --no-cache libc6-compat openssl
 WORKDIR /app
 
 COPY package.json package-lock.json* ./
-RUN npm ci --ignore-scripts --legacy-peer-deps
+# npm-Cache über BuildKit persistent halten (schnellere Re-Installs)
+RUN --mount=type=cache,target=/root/.npm npm ci --ignore-scripts --legacy-peer-deps
 
 # Stage 2: Builder
 FROM node:20-alpine AS builder
@@ -20,15 +22,16 @@ RUN npx prisma generate
 COPY .env.docker .env
 
 # Build Next.js
-ENV NEXT_TELEMETRY_DISABLED 1
-RUN npm run build
+ENV NEXT_TELEMETRY_DISABLED=1
+# .next/cache über BuildKit persistent halten → inkrementeller Build statt jedes Mal von Null
+RUN --mount=type=cache,target=/app/.next/cache npm run build
 
 # Stage 3: Runner
 FROM node:20-alpine AS runner
 RUN apk add --no-cache openssl
 
-ENV NODE_ENV production
-ENV NEXT_TELEMETRY_DISABLED 1
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
 
 RUN addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
@@ -62,7 +65,7 @@ COPY --chown=nextjs:nodejs server-custom.js ./server-custom.js
 COPY --chown=nextjs:nodejs docker-entrypoint.sh ./docker-entrypoint.sh
 
 EXPOSE 3000
-ENV PORT 3000
-ENV HOSTNAME "0.0.0.0"
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
 
 CMD ["sh", "docker-entrypoint.sh"]