ci: cap build to 2 of 4 cores so the Pi5 stays responsive

The self-hosted runner builds on the Pi5 alongside live services; the
unthrottled build saturated all cores (Go compiler + esbuild) and took the
reverse-proxied sites down. Add BUILD_CPUS build-arg → GOMAXPROCS in both
build stages (caps the Go compiler and Vite's esbuild) and go build -p,
plus nice/ionice on the build. Slower build, responsive host.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/Dockerfile

@@ -1,5 +1,14 @@
+# CPU budget for the build. The self-hosted runner builds on the Raspberry Pi 5
+# (4 cores) alongside live services, so we cap the CPU-heavy tools (the Go
+# compiler and esbuild — both honour GOMAXPROCS) to leave cores for nginx/NPM
+# and the other containers. Lower = gentler but slower; raise for a faster box.
+ARG BUILD_CPUS=2
+
 # ── Stage 1: Build frontend ───────────────────────────────────────────────────
 FROM node:20-alpine AS frontend-builder
+ARG BUILD_CPUS
+# esbuild (used by Vite) is a Go program and respects GOMAXPROCS.
+ENV GOMAXPROCS=${BUILD_CPUS}
 
 WORKDIR /app/frontend
 COPY frontend/package*.json ./
@@ -10,6 +19,9 @@ RUN npm run build
 # ── Stage 2: Build backend ────────────────────────────────────────────────────
 # Go 1.25 required by the OIDC dependency chain (go-oidc/v3, go-jose/v4).
 FROM golang:1.25-alpine AS backend-builder
+ARG BUILD_CPUS
+# Cap the Go compiler's parallelism to keep the Pi responsive during CI.
+ENV GOMAXPROCS=${BUILD_CPUS}
 
 WORKDIR /app/backend
 # Copy go.mod first for layer caching. go.sum is written by go mod download
@@ -18,8 +30,8 @@ COPY backend/go.mod ./
 COPY backend/go.su[m] ./
 RUN go mod download -x
 COPY backend/ ./
-# CGO disabled — pure Go SQLite (modernc.org/sqlite).
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /archivum ./cmd/server
+# CGO disabled — pure Go SQLite (modernc.org/sqlite). -p limits parallel builds.
+RUN CGO_ENABLED=0 go build -p ${BUILD_CPUS} -ldflags="-s -w" -o /archivum ./cmd/server
 
 # ── Stage 3: Runtime image ────────────────────────────────────────────────────
 FROM alpine:3.20