Use BuildKit cache mounts and multi-stage build for the Docker image

Split the Dockerfile into a builder stage (apk + pip cache mounts) and a
slim runtime stage, mirroring reimpasto. apk and pip package caches now
persist across builds and never land in the image layers.

Dockerfile

@@ -1,31 +1,46 @@
-FROM alpine:3.24
+# syntax=docker/dockerfile:1
+# Multi-stage production build for the kaya-rbcs app on the Kaya framework.
+# Base: alpine:3.24 (python3 = 3.14). Deps are installed into a venv in the
+# builder; apk and pip caches use BuildKit cache mounts so they persist across
+# builds and never land in the image layers. Requires BuildKit (default for
+# `docker build` / `docker buildx` on modern daemons).
 
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1 \
-    PIP_NO_CACHE_DIR=1 \
-    RBCS_HOST=0.0.0.0 \
-    RBCS_PORT=8080 \
-    RBCS_MEMCACHE_HOST=memcached \
-    RBCS_MEMCACHE_PORT=11211
+# --- Builder ---------------------------------------------------------------
+FROM alpine:3.24 AS builder
 
-RUN apk add --no-cache python3
+RUN --mount=type=cache,target=/var/cache/apk \
+    apk add python3
 
-WORKDIR /opt/kaya-rbcs
+WORKDIR /build
 
 COPY requirements.txt ./
-RUN python3 -m venv /opt/venv \
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3 -m venv /opt/venv \
  && /opt/venv/bin/pip install -r requirements.txt
 
 COPY pyproject.toml README.md ./
 COPY src ./src
-RUN /opt/venv/bin/pip install --no-deps .
 
-RUN addgroup -S rbcs \
-    && adduser -S -G rbcs rbcs \
-    && chown -R rbcs:rbcs /opt/kaya-rbcs /opt/venv
+RUN --mount=type=cache,target=/root/.cache/pip \
+    /opt/venv/bin/pip install --no-deps .
 
-ENV PATH="/opt/venv/bin:${PATH}"
+# --- Runtime ---------------------------------------------------------------
+FROM alpine:3.24
+
+RUN --mount=type=cache,target=/var/cache/apk \
+    apk add python3 ca-certificates tzdata \
+ && addgroup -S rbcs && adduser -S -G rbcs rbcs
+
+COPY --from=builder /opt/venv /opt/venv
+
+ENV PATH="/opt/venv/bin:${PATH}" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    RBCS_HOST=0.0.0.0 \
+    RBCS_PORT=8080 \
+    RBCS_MEMCACHE_HOST=memcached \
+    RBCS_MEMCACHE_PORT=11211
 
 USER rbcs