perf: cache pip downloads and Docker layers in CI build

- Add BuildKit pip cache mount to Dockerfile (persists torch/transformers
  downloads across builds on the runner host)
- Enable DOCKER_BUILDKIT=1 in workflow env
- Pull previous image before build for layer cache reuse
- Add --cache-from latest + BUILDKIT_INLINE_CACHE=1 to docker build

BUILDKIT_INLINE_CACHE embeds cache metadata in the pushed image so
--cache-from works from the registry (cold runner or new runner).
SHA tag push reuses already-pushed layers - only metadata transferred.

Expected improvement:
- Unchanged code:       ~5 min -> ~30 sec (layer cache hit)
- requirements changed: ~5 min -> ~1 min (pip disk cache)
- Push:                 only changed layers uploaded; SHA tag is free

.gitea/workflows/deploy.yml

@@ -14,6 +14,7 @@ jobs:
       PATH: /usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/bin:/snap/bin
       DOCKER_HOST: unix:///var/run/docker.sock
       IMAGE: registry.i80.dk/gitea/mmd
+      DOCKER_BUILDKIT: "1"
 
     steps:
     - name: Checkout code
@@ -29,9 +30,14 @@ jobs:
       run: |
         echo "${{ secrets.HARBOR_ROBOT_TOKEN }}" | docker login registry.i80.dk -u "robot\$gitserver" --password-stdin
 
+    - name: Pull previous image for layer cache
+      run: docker pull $IMAGE:latest || true
+
     - name: Build Docker image
       run: |
         docker build \
+          --cache-from $IMAGE:latest \
+          --build-arg BUILDKIT_INLINE_CACHE=1 \
           --build-arg BUILD_VERSION="${{ github.ref_name }}-${{ github.sha }}" \
           --build-arg GIT_COMMIT="${{ github.sha }}" \
           --build-arg BUILD_TIME="${{ github.event.head_commit.timestamp }}" \