ci: login before Prepare Buildx to fix 401 Unauthorized push

Move Login Registry stage before Prepare Buildx so Docker credentials are
in /root/.docker/config.json BEFORE the buildx docker-container builder
is created and bootstrapped. Previously the builder started without auth,
causing buildx --push to fail with '401 Unauthorized' on the manifest
HEAD request (blob layers pushed but manifest rejected).

Also expand the NO_PROXY driver-opt from just 'reg.nxsir.cn' to the full
NO_PROXY_HOSTS list (Tsighua, MCR, daocloud) so the buildkit container
itself also bypasses the proxy for these direct-reachable registries.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Jenkinsfile

@@ -52,6 +52,23 @@ pipeline {
             }
         }
 
+        stage('Login Registry') {
+            steps {
+                withCredentials([
+                    usernamePassword(
+                        credentialsId: "${DOCKER_CREDS}",
+                        usernameVariable: 'DOCKER_USERNAME',
+                        passwordVariable: 'DOCKER_PASSWORD'
+                    )
+                ]) {
+                    sh """
+                        set -e
+                        echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
+                    """
+                }
+            }
+        }
+
         stage('Prepare Buildx') {
             steps {
                 sh """
@@ -85,6 +102,8 @@ pipeline {
 EOF
 
                     # Recreate the builder to make sure the config takes effect (idempotent).
+                    # Login happens first so auth is in /root/.docker/config.json before the
+                    # builder container starts — buildx forwards auth via its session mechanism.
                     sudo docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true
                     sudo docker buildx create \
                       --name ${BUILDER_NAME} \
@@ -92,10 +111,10 @@ EOF
                       --driver-opt network=host \
                       --driver-opt 'env.HTTP_PROXY=${HTTP_PROXY_URL}' \
                       --driver-opt 'env.HTTPS_PROXY=${HTTP_PROXY_URL}' \
-                      --driver-opt 'env.NO_PROXY=reg.nxsir.cn' \
+                      --driver-opt 'env.NO_PROXY=${NO_PROXY_HOSTS}' \
                       --driver-opt 'env.http_proxy=${HTTP_PROXY_URL}' \
                       --driver-opt 'env.https_proxy=${HTTP_PROXY_URL}' \
-                      --driver-opt 'env.no_proxy=reg.nxsir.cn' \
+                      --driver-opt 'env.no_proxy=${NO_PROXY_HOSTS}' \
                       --config \$BUILDKITD_TOML \
                       --use
                     sudo docker buildx inspect --builder ${BUILDER_NAME} --bootstrap >/dev/null
@@ -103,23 +122,6 @@ EOF
             }
         }
 
-        stage('Login Registry') {
-            steps {
-                withCredentials([
-                    usernamePassword(
-                        credentialsId: "${DOCKER_CREDS}",
-                        usernameVariable: 'DOCKER_USERNAME',
-                        passwordVariable: 'DOCKER_PASSWORD'
-                    )
-                ]) {
-                    sh """
-                        set -e
-                        echo "\$DOCKER_PASSWORD" | sudo docker login ${REGISTRY_URL} -u "\$DOCKER_USERNAME" --password-stdin
-                    """
-                }
-            }
-        }
-
         stage('Build And Push API Image') {
             steps {
                 sh """