image(server): install musl target after rust-toolchain.toml, matching broker

Same fix pattern that unblocked broker in 534eb72. The `rustup target add`
was landing on the base image's default toolchain, but rust-toolchain.toml
(channel = 1.96.0) can prompt rustup to resolve to a distinct pinned
toolchain the target hasn't been installed on. Move the target install
after the COPY so it lands on the toolchain cargo actually uses.

images/server.Dockerfile

@@ -7,11 +7,6 @@ ARG TARGETARCH
 RUN apt-get update \
     && apt-get install -y --no-install-recommends musl-tools git cmake make pkg-config \
     && rm -rf /var/lib/apt/lists/*
-RUN case "$TARGETARCH" in \
-      arm64) echo aarch64-unknown-linux-musl > /rust-target ;; \
-      *)     echo x86_64-unknown-linux-musl  > /rust-target ;; \
-    esac \
-    && rustup target add "$(cat /rust-target)"
 WORKDIR /src
 COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
 COPY crates ./crates
@@ -19,6 +14,15 @@ COPY tools ./tools
 COPY images/seccomp ./images/seccomp
 COPY migrations ./migrations
 COPY .sqlx ./.sqlx
+# Install the musl target AFTER rust-toolchain.toml is in place, so rustup adds
+# it to the toolchain the workspace pins (channel 1.96.0), not the base image's
+# default. Doing this before the COPY installs into a toolchain cargo won't
+# actually use, and the build then fails with E0463 (no core for musl).
+RUN case "$TARGETARCH" in \
+      arm64) echo aarch64-unknown-linux-musl > /rust-target ;; \
+      *)     echo x86_64-unknown-linux-musl  > /rust-target ;; \
+    esac \
+    && rustup target add "$(cat /rust-target)"
 ENV SQLX_OFFLINE=true
 # Fetch git deps with the system git (libgit2 fails against Gitea smart-HTTP);
 # build the zlib-ng C dep with the musl cross compiler for the static target.