ci: exclude direct-reachable mirrors from HTTP proxy to fix apt 502

The 7890 proxy intermittently returns '502 Bad Gateway' when tunneling to
mirrors.tuna.tsinghua.edu.cn (observed on libglapi-mesa during
apt-get install in the runtime layer). The Tsinghua mirror, MCR, and
daocloud are all directly reachable from this builder, so the proxy adds
no value and only introduces failure modes.

Add the following hosts to NO_PROXY_HOSTS so apt/curl inside the build
containers hit them directly:
  - mirrors.tuna.tsinghua.edu.cn, .tsinghua.edu.cn
  - mcr.microsoft.com
  - docker.m.daocloud.io

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Jenkinsfile

@@ -18,7 +18,9 @@ pipeline {
         WEB_NODE_IMAGE    = 'docker.m.daocloud.io/library/node:22-alpine'
         WEB_NGINX_IMAGE   = 'docker.m.daocloud.io/library/nginx:1.27-alpine'
         HTTP_PROXY_URL    = 'http://192.168.5.200:7890'
-        NO_PROXY_HOSTS    = '127.0.0.1,localhost,reg.nxsir.cn,gitea.nxsir.cn'
+        // Tsinghua/daocloud/mcr hosts are reachable directly from the builder — routing them
+        // through the 7890 proxy caused intermittent '502 Bad Gateway' during apt-get install.
+        NO_PROXY_HOSTS    = '127.0.0.1,localhost,reg.nxsir.cn,gitea.nxsir.cn,mirrors.tuna.tsinghua.edu.cn,.tsinghua.edu.cn,mcr.microsoft.com,docker.m.daocloud.io'
 
         GIT_REPO_URL = 'https://gitea.nxsir.cn/nanxun/live_recorder.git'
         GIT_BRANCH   = 'main'