🎨 优化dockerfile编译，限制资源

Dockerfile

@@ -10,8 +10,9 @@ RUN cargo chef prepare --recipe-path recipe.json
 
 FROM node:24-alpine AS frontend-builder
 WORKDIR /app/admin-ui
-COPY admin-ui/package.json ./
-RUN npm install -g pnpm && pnpm install
+# 单独复制依赖文件，利用层缓存：只有依赖变化时才重新安装
+COPY admin-ui/package.json admin-ui/bun.lock* ./
+RUN npm install -g pnpm && pnpm install --frozen-lockfile
 COPY admin-ui ./
 RUN pnpm build
 
@@ -20,11 +21,15 @@ FROM chef AS builder
 # 可选：启用敏感日志输出（仅用于排障）
 ARG ENABLE_SENSITIVE_LOGS=false
 
+# 可按需在构建时覆盖：docker compose build --build-arg CARGO_BUILD_JOBS=48
+ARG CARGO_BUILD_JOBS=8
+ENV CARGO_BUILD_JOBS=${CARGO_BUILD_JOBS}
+
 COPY --from=planner /app/recipe.json recipe.json
 RUN if [ "$ENABLE_SENSITIVE_LOGS" = "true" ]; then \
-        cargo chef cook --release --features sensitive-logs --recipe-path recipe.json; \
+        cargo chef cook --profile docker-release --features sensitive-logs --recipe-path recipe.json; \
     else \
-        cargo chef cook --release --recipe-path recipe.json; \
+        cargo chef cook --profile docker-release --recipe-path recipe.json; \
     fi
 
 COPY Cargo.toml Cargo.lock* ./
@@ -32,9 +37,9 @@ COPY src ./src
 COPY --from=frontend-builder /app/admin-ui/dist /app/admin-ui/dist
 
 RUN if [ "$ENABLE_SENSITIVE_LOGS" = "true" ]; then \
-        cargo build --release --features sensitive-logs; \
+        cargo build --profile docker-release --features sensitive-logs; \
     else \
-        cargo build --release; \
+        cargo build --profile docker-release; \
     fi
 
 FROM alpine:3.21
@@ -42,7 +47,8 @@ FROM alpine:3.21
 RUN apk add --no-cache ca-certificates
 
 WORKDIR /app
-COPY --from=builder /app/target/release/kiro-rs /app/kiro-rs
+# docker-release profile 产物路径为 target/docker-release/
+COPY --from=builder /app/target/docker-release/kiro-rs /app/kiro-rs
 
 VOLUME ["/app/config"]