Build from mirrored nginx base image

Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:1.28-alpine
+FROM git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64
 
 ARG COMMIT_ID=unknown
 

README.md

@@ -6,7 +6,7 @@ Git commit used to build the published container.
 ## Run it
 
 ```sh
-docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.1
+docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.2
 ```
 
 Open <http://localhost:8080>. The health endpoint is available at
@@ -32,6 +32,10 @@ The Gitea Actions workflow publishes the following tags for `v1.2.3`:
 The workflow publishes `linux/amd64` images to
 `git.mancheff.com/hiyv-demo/hiyv-nginx`.
 
+The pinned upstream nginx base is mirrored at
+`git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64` so the self-hosted
+runner does not depend on Docker Hub connectivity during releases.
+
 The repository must define two Actions secrets: `REGISTRY_USERNAME` with the
 Gitea username and `REGISTRY_TOKEN` with a personal access token that has
 package write access. Gitea's automatic job token cannot currently publish OCI