Install Seafile CLI from AppImage instead of the APT repository

Seafile discontinued linux-clients.seafile.com: it resolves but accepts
no connections on 80 or 443, and the official docs no longer mention APT
at all. Every `docker build` has failed since. Upstream now ships the CLI
as an AppImage, so install 9.0.19 from the download site.

The AppImage is unpacked rather than executed. Running one needs FUSE and
so a privileged container, and its self-extraction also fails when the
build host cannot execute the payload's architecture. Unpacking the
appended squashfs directly avoids both.

Also add the bundled seafile/pysearpc bindings to the venv path. The APT
package installed them system-wide, where `venv --system-site-packages`
picked them up; dsc imports seafile directly for RPC, not only through
seaf-cli, so it broke when that implicit dependency went away.

Drops apt-key, pins the version, and verifies a SHA256 before unpacking.
Build-time smoke checks assert the seaf-cli subcommands and the app's own
imports.

Note: the AppImage is x86_64-only, and upstream publishes no digest or
signature, so the pinned checksum is trust-on-first-use.

IMPROVEMENTS.md

@@ -11,11 +11,14 @@ exploit scenarios are discussed in public issues.
 
 ### Restore reproducible image builds
 
-- [ ] Replace the unavailable Seafile APT repository used in `Dockerfile`.
-- [ ] Install a supported Seafile CLI version from an official source.
-- [ ] Pin the version and verify its checksum or signature during the build.
-- [ ] Remove `apt-key`, which is deprecated and trusts keys globally.
-- [ ] Add a smoke check that `seaf-cli` runs to the image build. Note that
+- [x] Replace the unavailable Seafile APT repository used in `Dockerfile`.
+  Upstream discontinued it; the CLI now ships as an x86_64-only AppImage.
+- [x] Install a supported Seafile CLI version from an official source.
+- [x] Pin the version and verify its checksum during the build. The checksum is
+  trust-on-first-use: upstream publishes no digest or signature alongside the
+  AppImage, so this is weaker than the signed APT repository it replaces.
+- [x] Remove `apt-key`, which is deprecated and trusts keys globally.
+- [x] Add a smoke check that `seaf-cli` runs to the image build. Note that
   `seaf-cli` has no `--version` flag; use `seaf-cli --help` and assert the
   expected subcommands, and record the installed version from the package
   manager instead.