fix(ci): use kankali ssh host and shorten secret clone step

Dockerfile.cicd

@@ -6,7 +6,7 @@
 # Phase 4-6: Install packages and verify (requires full source)
 #
 # BENEFITS: Dependency installation ~20-30 minutes is cached across source code changes
-ARG CICD_BASE_IMAGE=dogar.darkhelm.org/darkhelm.org/plex-playlist/cicd-base:latest
+ARG CICD_BASE_IMAGE=kankali.darkhelm.lan:3001/darkhelm.org/plex-playlist-cicd-base:latest
 FROM ${CICD_BASE_IMAGE}
 
 # Build args for cache busting
@@ -25,16 +25,16 @@ RUN --mount=type=secret,id=ssh_private_key \
     mkdir -p ~/.ssh && \
     cp /run/secrets/ssh_private_key ~/.ssh/id_rsa && \
     chmod 600 ~/.ssh/id_rsa && \
-    echo "Host dogar.darkhelm.org" > ~/.ssh/config && \
+    echo "Host kankali.darkhelm.lan" > ~/.ssh/config && \
     echo "    Port 2222" >> ~/.ssh/config && \
     echo "    StrictHostKeyChecking no" >> ~/.ssh/config && \
     echo "    UserKnownHostsFile /dev/null" >> ~/.ssh/config && \
     chmod 600 ~/.ssh/config && \
-    ssh-keyscan -p 2222 dogar.darkhelm.org >> ~/.ssh/known_hosts 2>/dev/null && \
+    ssh-keyscan -p 2222 kankali.darkhelm.lan >> ~/.ssh/known_hosts 2>/dev/null && \
     echo "=== Extracting dependency files for optimized caching ===" && \
     GIT_SSH_COMMAND="ssh -F ~/.ssh/config" \
     git clone --depth 1 --branch main \
-    ssh://git@dogar.darkhelm.org:2222/DarkHelm.org/plex-playlist.git /tmp/repo && \
+    ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git /tmp/repo && \
     if [ -n "$GITHUB_SHA" ]; then \
         cd /tmp/repo && git checkout "$GITHUB_SHA" 2>/dev/null || echo "Using main branch HEAD"; \
     fi && \
@@ -134,52 +134,50 @@ RUN --mount=type=secret,id=ssh_private_key \
     mkdir -p ~/.ssh && \
     cp /run/secrets/ssh_private_key ~/.ssh/id_rsa && \
     chmod 600 ~/.ssh/id_rsa && \
-    echo "Host dogar.darkhelm.org" > ~/.ssh/config && \
+    echo "Host kankali.darkhelm.lan" > ~/.ssh/config && \
     echo "    Port 2222" >> ~/.ssh/config && \
     echo "    StrictHostKeyChecking no" >> ~/.ssh/config && \
     echo "    UserKnownHostsFile /dev/null" >> ~/.ssh/config && \
     chmod 600 ~/.ssh/config && \
-    ssh-keyscan -p 2222 dogar.darkhelm.org >> ~/.ssh/known_hosts 2>/dev/null && \
-    # Clone full repository (dependencies already installed, this won't bust cache layers)
+    ssh-keyscan -p 2222 kankali.darkhelm.lan >> ~/.ssh/known_hosts 2>/dev/null && \
+    # Keep the secret-mounted step minimal to avoid BuildKit session timeouts.
     GIT_SSH_COMMAND="ssh -F ~/.ssh/config" \
     git clone --depth 1 --branch main \
-    ssh://git@dogar.darkhelm.org:2222/DarkHelm.org/plex-playlist.git /tmp/fullrepo && \
+    ssh://git@kankali.darkhelm.lan:2222/DarkHelm.org/plex-playlist.git /tmp/fullrepo && \
     if [ -n "$GITHUB_SHA" ]; then \
         cd /tmp/fullrepo && git checkout "$GITHUB_SHA" 2>/dev/null || echo "Using main branch HEAD"; \
     fi && \
-    # Copy source code while preserving installed dependencies
-    echo "Copying source code while preserving installed dependencies..." && \
-    # Instead of backup/restore, copy selectively to avoid overwriting dependencies
+    rm -rf ~/.ssh
+
+RUN echo "Copying source code while preserving installed dependencies..." && \
     echo "Source files in repo:" && \
     ls -la /tmp/fullrepo/ && \
     echo "Current workspace state:" && \
     find /workspace -name "node_modules" -o -name ".venv" -o -name ".yarn" && \
-    # Copy source files excluding dependency directories
     echo "Copying source files (excluding dependencies)..." && \
-    # Copy all files and directories except the ones we want to preserve
     for item in /tmp/fullrepo/*; do \
         basename_item=$(basename "$item"); \
-        target_path="/workspace/$basename_item"; \
         if [ "$basename_item" = "backend" ] && [ -d "/workspace/backend/.venv" ]; then \
             echo "Copying backend files while preserving .venv..."; \
-            # Copy backend files but skip .venv if it exists
             find "$item" -mindepth 1 -maxdepth 1 ! -name ".venv" -exec cp -rf {} /workspace/backend/ \;; \
         elif [ "$basename_item" = "frontend" ] && ([ -d "/workspace/frontend/node_modules" ] || [ -f "/workspace/frontend/.pnp.cjs" ]); then \
             echo "Copying frontend files (will regenerate Yarn state after)..."; \
-            # Copy all frontend files normally - we'll regenerate Yarn state afterward
             cp -rf "$item"/* /workspace/frontend/; \
         else \
             echo "Copying $basename_item..."; \
             cp -rf "$item" /workspace/; \
         fi; \
     done && \
-    # Copy hidden files from root (like .gitignore, .dockerignore, etc.)
-    cp -rf /tmp/fullrepo/.* /workspace/ 2>/dev/null || true && \
-    # Verify dependencies are still there
+    # Copy common hidden root files without touching . or ..
+    for dotfile in .dockerignore .gitignore .pre-commit-config.yaml .editorconfig; do \
+        if [ -f "/tmp/fullrepo/${dotfile}" ]; then \
+            cp -f "/tmp/fullrepo/${dotfile}" /workspace/; \
+        fi; \
+    done && \
     echo "Final dependency check:" && \
     find /workspace -name "node_modules" -o -name ".venv" -o -name ".yarn" && \
     echo "✓ Full source code copied, dependencies preserved" && \
-    rm -rf /tmp/fullrepo ~/.ssh
+    rm -rf /tmp/fullrepo
 
 # PHASE 3.5: Regenerate Yarn PnP state after source code update
 WORKDIR /workspace/frontend