build(docker): supply Gitea feed + optional NuGet credentials for image restore

Dockerfile copies nuget.config (so the Gitea feed + source mapping are known in
the restore stage) and accepts optional NUGET_GITEA_USER/PASS build-args for a
private feed; build.sh forwards them from host env vars (MXGW_NUGET_USER/PASS)
so secrets are never committed. Verified the in-container restore resolves the
ZB.MOM.WW.MxGateway.* packages (anonymous feed).

docker/build.sh

@@ -12,11 +12,21 @@ if ! docker network inspect scadabridge-net >/dev/null 2>&1; then
     docker network create scadabridge-net
 fi
 
+# Optional credentials for the private Gitea NuGet feed (ZB.MOM.WW.MxGateway.*).
+# Read from the host environment so secrets are never committed. Leave unset for an
+# anonymous feed. Export MXGW_NUGET_USER / MXGW_NUGET_PASS before running deploy.
+NUGET_ARGS=()
+if [ -n "${MXGW_NUGET_USER:-}" ]; then
+    NUGET_ARGS+=(--build-arg "NUGET_GITEA_USER=${MXGW_NUGET_USER}")
+    NUGET_ARGS+=(--build-arg "NUGET_GITEA_PASS=${MXGW_NUGET_PASS:-}")
+fi
+
 # Build from repo root (so COPY paths in Dockerfile resolve correctly)
 echo "Building scadabridge:latest image..."
 docker build \
     -t scadabridge:latest \
     -f "$SCRIPT_DIR/Dockerfile" \
+    "${NUGET_ARGS[@]}" \
     "$REPO_ROOT"
 
 echo "Build complete: scadabridge:latest"