ci: re-login before each docker push, embed withCredentials in build stages

docker push is also getting 401 (not just buildx --push), suggesting
the Harbor login token expires during long builds or there is a
credential propagation gap between the standalone Login stage and the
build stages.

Move withCredentials into each build stage and re-login immediately
before every docker push / manifest push. This gives each push
operation a fresh token.

Pipeline is now: Checkout -> Prepare Buildx -> Build API (login + build
+ push + manifest) -> Build Web (same).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Jenkinsfile

@@ -52,23 +52,6 @@ pipeline {
             }
         }
 
-        stage('Login Registry') {
-            steps {
-                withCredentials([
-                    usernamePassword(
-                        credentialsId: "${DOCKER_CREDS}",
-                        usernameVariable: 'DOCKER_USERNAME',
-                        passwordVariable: 'DOCKER_PASSWORD'
-                    )
-                ]) {
-                    sh """
-                        set -e
-                        echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
-                    """
-                }
-            }
-        }
-
         stage('Prepare Buildx') {
             steps {
                 sh """
@@ -96,6 +79,13 @@ pipeline {
 
         stage('Build And Push API Image') {
             steps {
+                withCredentials([
+                    usernamePassword(
+                        credentialsId: "${DOCKER_CREDS}",
+                        usernameVariable: 'DOCKER_USERNAME',
+                        passwordVariable: 'DOCKER_PASSWORD'
+                    )
+                ]) {
                 sh """
                     set -e
 
@@ -167,6 +157,9 @@ pipeline {
                           .
 
                       echo "=== Pushing \$PLAT_REF ==="
+                      # Re-login immediately before push — Harbor tokens can be
+                      # short-lived and expire during long QEMU builds.
+                      echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -5
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -5
 
@@ -176,6 +169,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${API_IMAGE_TAGGED} ==="
+                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
                     sudo docker manifest create "${API_IMAGE_TAGGED}" \
                       "${API_IMAGE_TAGGED}-amd64" \
                       "${API_IMAGE_TAGGED}-arm64"
@@ -193,11 +187,19 @@ pipeline {
                     echo "  ${API_IMAGE_TAGGED}"
                     echo "  ${API_IMAGE_LATEST}"
                 """
+                }
             }
         }
 
         stage('Build And Push Web Image') {
             steps {
+                withCredentials([
+                    usernamePassword(
+                        credentialsId: "${DOCKER_CREDS}",
+                        usernameVariable: 'DOCKER_USERNAME',
+                        passwordVariable: 'DOCKER_PASSWORD'
+                    )
+                ]) {
                 sh """
                     set -e
 
@@ -267,6 +269,7 @@ pipeline {
                           frontend
 
                       echo "=== Pushing \$PLAT_REF ==="
+                      echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
                       sudo docker push "\$PLAT_REF" 2>&1 | tail -3
                       sudo docker push "\$PLAT_LATEST" 2>&1 | tail -3
                       sudo docker rmi "\$PLAT_REF" "\$PLAT_LATEST" 2>/dev/null || true
@@ -274,6 +277,7 @@ pipeline {
 
                     echo ''
                     echo "=== Creating multi-arch manifest: ${WEB_IMAGE_TAGGED} ==="
+                    echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin 2>&1 | tail -1
                     sudo docker manifest create "${WEB_IMAGE_TAGGED}" \
                       "${WEB_IMAGE_TAGGED}-amd64" \
                       "${WEB_IMAGE_TAGGED}-arm64"
@@ -290,6 +294,7 @@ pipeline {
                     echo "  ${WEB_IMAGE_TAGGED}"
                     echo "  ${WEB_IMAGE_LATEST}"
                 """
+                }
             }
         }
     }