Allow per-build Debian mirror with standard APT verification

Dockerfile

@@ -2,11 +2,12 @@ ARG PYTHON_BASE=python:3.14.5-slim-bookworm@sha256:ec58d916f9e24a6035cab2bdf07f6
 FROM ${PYTHON_BASE}
 ARG BUILD_COMMIT=development
 ARG BUILD_TIME=unknown
+ARG DEBIAN_MIRROR=deb.debian.org
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 TZ=Asia/Shanghai \
     DATA_DIR=/data CONFIG_DIR=/config BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
 WORKDIR /app
 # CJK fonts intentionally retained for readable Chinese rendering.
-RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' /etc/apt/sources.list.d/debian.sources \
+RUN sed -i "s|http://deb.debian.org|https://${DEBIAN_MIRROR}|g" /etc/apt/sources.list.d/debian.sources \
     && apt-get update && apt-get install -y --no-install-recommends fonts-noto-cjk tzdata \
     && rm -rf /var/lib/apt/lists/* \
     && groupadd --gid 10333 frameflow && useradd --uid 10333 --gid 10333 --no-create-home frameflow \

docs/NAS.md

@@ -126,3 +126,10 @@ sudo env DOCKER_BUILDKIT=0 /usr/local/bin/docker compose build \
 ```
 
 This per-build override does not change global registry or network configuration.
+
+A slow Debian CDN can be overridden only for this build, retaining APT GPG
+verification and changing no NAS system settings:
+
+```sh
+sudo /usr/local/bin/docker compose build --build-arg DEBIAN_MIRROR=mirrors.aliyun.com
+```