fix(ci): bound Docker build cache with BuildKit cache mounts

- Move the pnpm store, apk and .next caches into --mount=type=cache so
  dependencies are shared across builds instead of duplicated in fresh
  image layers (was the source of unbounded disk growth).
- Replace the deprecated --keep-storage prune flag in ci-deploy.sh with
  the working --max-used-space=4g (buildx v0.37 renamed the flag). The
  deprecated flag silently did nothing, so the BuildKit cache kept
  growing unbounded (was 15.86GB); it is now capped at 4GB after every
  deploy.

src/lib/deploy-workflow-contract.test.ts

@@ -27,7 +27,7 @@ it("preserves production runtime configuration and recent cache", () => {
 	expect(deploy).toContain("/app/storage");
 	expect(deploy).not.toContain("--env-file");
 	expect(deploy).toContain(
-		'docker builder prune -af --filter "until=72h" --keep-storage=2g',
+		'docker builder prune -af --filter "until=72h" --max-used-space=4g',
 	);
 	expect(deploy).not.toContain("docker volume prune");
 });