feat: v0.10.0 生产环境优化 — HTTPS、前端生产构建、安全加固

- feat(deploy): 前端多阶段构建 (vite build + nginx:alpine)，移除 Vite 开发模式
- feat(deploy): OpenResty HTTPS 配置 (SSL + HSTS + 安全头)
- fix(ws): WebSocket 路由添加 /api 前缀，修正前后端路径不匹配
- security: SSH AutoAddPolicy → WarningPolicy
- security: CORS 来源环境变量化 (CORS_ORIGINS)
- security: 限流器使用 X-Forwarded-For 真实客户端 IP
- perf(db): 数据库连接池配置 (pool_size=20, max_overflow=40)
- refactor: 移除硬编码 URL/IP (NTP、域名、微信代理)，改为环境变量
- chore: 更新 .env.example 模板，补充新增配置项
- chore: 清理 .reasonix/、scripts/、guide.md 无用文件
- docs: 更新 CLAUDE.md 至 v0.10.0，补充生产架构文档

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -16,15 +16,23 @@ services:
       - CASDOOR_CERTIFICATE=${CASDOOR_CERTIFICATE}
       - CASDOOR_ORG_NAME=${CASDOOR_ORG_NAME}
       - CASDOOR_APP_NAME=${CASDOOR_APP_NAME}
+      - CASDOOR_REDIRECT_URL=${CASDOOR_REDIRECT_URL:-}
       - SECRET_KEY=${SECRET_KEY}
       - DEBUG=${DEBUG:-false}
+      - CORS_ORIGINS=${CORS_ORIGINS:-}
+      - FRONTEND_URL=${FRONTEND_URL:-https://onu.dhdx.fun}
+      - NTP_OLD_SERVER=${NTP_OLD_SERVER:-172.16.0.254}
+      - NTP_NEW_SERVER=${NTP_NEW_SERVER:-172.16.1.252}
+      - IMC_API_URL=${IMC_API_URL:-}
+      - IMC_API_USERNAME=${IMC_API_USERNAME:-}
+      - IMC_API_PASSWORD=${IMC_API_PASSWORD:-}
       - WECHAT_CORPID=${WECHAT_CORPID:-}
       - WECHAT_CORPSECRET=${WECHAT_CORPSECRET:-}
       - WECHAT_AGENTID=${WECHAT_AGENTID:-}
       - WECHAT_TOKEN=${WECHAT_TOKEN:-}
       - WECHAT_ENCODING_AES_KEY=${WECHAT_ENCODING_AES_KEY:-}
       - WECHAT_USE_PROXY=${WECHAT_USE_PROXY:-True}
-      - WECHAT_PROXY_API_URL=${WECHAT_PROXY_API_URL:-https://api.v6ole.top}
+      - WECHAT_PROXY_API_URL=${WECHAT_PROXY_API_URL:-}
     volumes:
       - ../backend/logs:/app/logs
       - ../backend/static:/app/static
@@ -96,26 +104,19 @@ services:
       - backend
     restart: unless-stopped
 
-  # 前端应用
+  # 前端应用（生产模式：nginx 静态文件服务）
   frontend:
     build:
       context: ../frontend
       dockerfile: Dockerfile
     container_name: h3c-onu-ms-frontend
     ports:
-      - "5173:5173"
-    environment:
-      - VITE_API_BASE_URL=${VITE_API_BASE_URL:-http://localhost:8001}
-      - VITE_API_PROXY_TARGET=http://backend:8000
-      - VITE_CASDOOR_ENDPOINT=${VITE_CASDOOR_ENDPOINT}
-      - VITE_CASDOOR_CLIENT_ID=${VITE_CASDOOR_CLIENT_ID}
-      - VITE_CASDOOR_ORG_NAME=${VITE_CASDOOR_ORG_NAME}
-      - VITE_CASDOOR_APP_NAME=${VITE_CASDOOR_APP_NAME}
+      - "18062:80"
     depends_on:
       - backend
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:5173"]
+      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
       interval: 30s
       timeout: 10s
       retries: 3