build: NuGet cache mount + buildx registry cache

Mirror the cache infra added to nas-auth (commit a1ecba3):
- Dockerfile: `RUN --mount=type=cache,target=/root/.nuget/packages`
  for restore + publish, with syntax 1.6 directive.
- workflow: cache-from/cache-to registry cache mode=max, so buildkit
  layer cache survives across CI runs (fresh buildkit per run otherwise).

First run after this still pays full cost; each subsequent run should
drop ~50% off dotnet restore.

Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1.6
 # ─── Stage 1: build ───────────────────────────────────────────────────────────
 FROM mcr.microsoft.com/dotnet/sdk:10.0 AS builder
 
@@ -5,11 +6,13 @@ WORKDIR /src
 
 # 先只复制 csproj，利用层缓存加速 restore
 COPY obsidian-mcp.csproj ./
-RUN dotnet restore obsidian-mcp.csproj
+RUN --mount=type=cache,target=/root/.nuget/packages \
+    dotnet restore obsidian-mcp.csproj
 
 # 复制全部源码并 publish
 COPY . .
-RUN dotnet publish obsidian-mcp.csproj \
+RUN --mount=type=cache,target=/root/.nuget/packages \
+    dotnet publish obsidian-mcp.csproj \
     --configuration Release \
     --no-restore \
     --output /app/publish