perf(ci): cache cargo registry and target dir across image builds

Dockerfile.simple had no build caching at all - every push recompiled the
full dependency tree from scratch for every service, in release mode,
targeting musl with static OpenSSL (the slowest possible combination).
BuildKit cache mounts for /app/target and the cargo registry/git caches
persist across builds on the same runner node and are shared across all
20 services, since they overlap heavily on workspace dependencies.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Dockerfile.simple

@@ -1,5 +1,4 @@
-# Simple fast Dockerfile - no fancy caching, just builds fast
+# syntax=docker/dockerfile:1.7
-# Uses local cargo cache between builds
 
 ARG SERVICE_NAME
 
@@ -48,7 +47,14 @@ RUN svc=$(echo "${SERVICE_NAME}" | tr '-' '_') && \
 ENV RUSTFLAGS="-C target-feature=+crt-static -C link-arg=-s"
 ENV OPENSSL_STATIC=1
 ENV OPENSSL_DIR=/usr
-RUN cargo build --release \
+# Cache mounts persist across builds on the same runner node's buildkit
+# daemon (keyed by target path, shared across all 20 services' builds since
+# they overlap heavily on the same workspace deps) - avoids recompiling the
+# full dependency tree from scratch on every push.
+RUN --mount=type=cache,target=/app/target,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    cargo build --release \
     --bin $(cat /tmp/service_bin) \
     --target x86_64-unknown-linux-musl && \
     cp /app/target/x86_64-unknown-linux-musl/release/$(cat /tmp/service_bin) /app/service