fix(build): NodeSource repo via pkg-cache-repos.sh (pinned key, cache-aware)

install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash`
(an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same
nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the
signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE
the repo goes through the internal cache (https://192.168.1.40/nodesource/,
origin as 2nd baseurl) and the RUN restores the origin files at the end.
The unused N|Solid repo (18/20/22) is no longer added.

pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from
cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -34,8 +34,11 @@ RUN chmod +x /scripts/*
 # Generate self-signed cert, create needed dirs, install Node.js, clean up
 RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
     mkdir -p /var/log/nodejs && \
+    /usr/local/sbin/pkg-cache-repos.sh rpm && \
     /scripts/install-node.sh "$NODEVER" && \
-    rm -rf /tmp/*
+    /usr/local/sbin/pkg-cache-repos.sh restore && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf /tmp/*
 
 # Install PM2 globally for process management with minimal footprint
 RUN npm install -g pm2@latest --production && \