Fix: save OpenResty key as .asc to skip gpg --dearmor

apt 2.6 (Bookworm) accepts ASCII-armored keys via signed-by directly
when the file has a .asc extension. This removes the gpg pipeline whose
silent failure (no pipefail in /bin/sh) was producing an empty keyring.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/Dockerfile

@@ -58,9 +58,8 @@ RUN set -eux; \
     if [ "$WITH_POPPLER" = "1" ]; then apt-get install -y --no-install-recommends poppler-utils; fi; \
     if [ "$WITH_PSQL_CLIENT" = "1" ]; then apt-get install -y --no-install-recommends postgresql-client; fi; \
     if [ "$WITH_NGINX" = "1" ]; then \
-      apt-get install -y --no-install-recommends gnupg; \
-      curl -fsSL https://openresty.org/package/pubkey.gpg | gpg --dearmor | tee /usr/share/keyrings/openresty.gpg > /dev/null; \
-      echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/debian bookworm openresty" | tee /etc/apt/sources.list.d/openresty.list; \
+      curl -fsSL https://openresty.org/package/pubkey.gpg -o /usr/share/keyrings/openresty.asc; \
+      echo "deb [signed-by=/usr/share/keyrings/openresty.asc] http://openresty.org/package/debian bookworm openresty" | tee /etc/apt/sources.list.d/openresty.list; \
       apt-get update; \
       apt-get install -y --no-install-recommends openresty libmaxminddb0; \
       opm get anjia0532/lua-resty-maxminddb; \