feat: v0.10.0 生产环境优化 — HTTPS、前端生产构建、安全加固

- feat(deploy): 前端多阶段构建 (vite build + nginx:alpine)，移除 Vite 开发模式
- feat(deploy): OpenResty HTTPS 配置 (SSL + HSTS + 安全头)
- fix(ws): WebSocket 路由添加 /api 前缀，修正前后端路径不匹配
- security: SSH AutoAddPolicy → WarningPolicy
- security: CORS 来源环境变量化 (CORS_ORIGINS)
- security: 限流器使用 X-Forwarded-For 真实客户端 IP
- perf(db): 数据库连接池配置 (pool_size=20, max_overflow=40)
- refactor: 移除硬编码 URL/IP (NTP、域名、微信代理)，改为环境变量
- chore: 更新 .env.example 模板，补充新增配置项
- chore: 清理 .reasonix/、scripts/、guide.md 无用文件
- docs: 更新 CLAUDE.md 至 v0.10.0，补充生产架构文档

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api/v1/olt.py

@@ -4,6 +4,7 @@ from sqlalchemy.orm import Session
 from sqlalchemy import distinct
 from pydantic import BaseModel
 from app.core.database import get_db
+from app.core.config import settings
 from app.middleware.permission_middleware import require_permission
 from app.models.device import OLTDevice
 import pandas as pd
@@ -501,8 +502,8 @@ def loopback_detection(
 
 
 class SyncNTPRequest(BaseModel):
-    old_server: str = "172.16.0.254"
-    new_server: str = "172.16.1.252"
+    old_server: str = settings.NTP_OLD_SERVER
+    new_server: str = settings.NTP_NEW_SERVER
 
 
 @router.post("/sync-ntp")

backend/app/api/v1/wechat.py

@@ -2,6 +2,7 @@
 import logging
 from fastapi import APIRouter, Request, Response
 from app.services.wechat_service import get_wechat_service
+from app.core.config import settings
 
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/api/wechat", tags=["企业微信回调"])
@@ -235,6 +236,6 @@ def _handle_help_cmd(svc, from_user: str):
         "• 发送「全离线」查看全离线学校\n"
         "• 发送 MAC 地址后四位查询设备\n\n"
         "💡 发送「帮助」显示此信息\n"
-        "💻 完整功能: https://onu.dhdx.fun",
+        f"💻 完整功能: {settings.FRONTEND_URL}",
         to_user=from_user
     )

backend/app/api/v1/ws.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 from app.core.config import settings
 
 logger = logging.getLogger(__name__)
-router = APIRouter()
+router = APIRouter(prefix="/api", tags=["WebSocket"])
 
 REDIS_CHANNEL = "h3c_onu:status_updates"
 _connected: set[WebSocket] = set()