feat(BA-7264): build service images from a shared backend.ai-base image

[kyujin-cho]

Summary

• Add docker/backend.ai-base.dockerfile: a shared, unpublished base image that installs every backend.ai package once — a joint pip wheel resolve of -r requirements.txt plus the seven service packages (--find-links=dist/, PyPI fallback), so dependency versions cannot drift from the tested set, with a BuildKit RUN --mount install so no wheel or dist bytes ship in any image layer.
• Rewrite the seven service dockerfiles as thin layers FROM backend.ai-base:${PKGVER}: every image now carries all packages and the full backend.ai CLI, differing only in default command, prepared directories, and extras (agent keeps its digest-pinned Docker CLI, entrypoint, and the krunner fail-fast probe). Multi-service hosts download the shared base layers once, and the same-version rule becomes structural.
• Default commands switch from python -m … to the backend.ai <alias> start-server lazy-import CLI entry points (mgr/ag/web/storage/app-proxy-*).
• Add docker-bake.hcl: the base is wired into the service targets as a named build context (target:base), so it is built in-run per platform and never needs to exist in a registry; tags, OCI labels, provenance+SBOM attestations, and per-image gha cache scopes live here.
• Register backend.ai-base as a build-only entry in scripts/list-dockerfiles.sh (excluded from --service publishing and --infra), and update docker/README.md for the base-image build contract.

Merge order note: stacked on #13703 (BA-7321) of the BA-7264 chain; retarget to main after the base PR merges. The CI switch to bake follows in the next PR of the stack.

Part of the BA-7264 epic (#13582).