ci: bump runner capacity to 4 and add BuildKit cache for image builds

- act_runner capacity 2 → 4 (QNAP host has 6 cores, leave 2 for OS)
- release-image: switch to docker/build-push-action@v5 with GHA cache
  (separate scopes for app/migrator to avoid cross-invalidation)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/gitea_compose_qnap_all_in_one.md

@@ -99,7 +99,7 @@ services:
           level: info
         runner:
           file: /data/.runner
-          capacity: 2
+          capacity: 4
           timeout: 3h
           insecure: false
           fetch_timeout: 5s

.github/workflows/release-image.yml

@@ -45,21 +45,27 @@ jobs:
 
       # Guardrail anchor: target: runner
       - name: Build and push app image
-        run: |
+        uses: docker/build-push-action@v5
-          docker buildx build --push \
+        with:
-            --tag "${{ steps.vars.outputs.app_image }}" \
+          context: .
-            --file ./Dockerfile.prod \
+          file: ./Dockerfile.prod
-            --target runner \
+          target: runner
-            .
+          push: true
+          tags: ${{ steps.vars.outputs.app_image }}
+          cache-from: type=gha,scope=app
+          cache-to: type=gha,mode=max,scope=app
 
       # Guardrail anchor: target: migrator
       - name: Build and push migrator image
-        run: |
+        uses: docker/build-push-action@v5
-          docker buildx build --push \
+        with:
-            --tag "${{ steps.vars.outputs.migrator_image }}" \
+          context: .
-            --file ./Dockerfile.prod \
+          file: ./Dockerfile.prod
-            --target migrator \
+          target: migrator
-            .
+          push: true
+          tags: ${{ steps.vars.outputs.migrator_image }}
+          cache-from: type=gha,scope=migrator
+          cache-to: type=gha,mode=max,scope=migrator
 
       - name: Release summary
         run: |