chore(deploy): CI 双轨——发版同时部署 EC2 + 阿里（EC2→Ali 迁移期）

deploy-{server,site,client}.sh 目标主机参数化（DEPLOY_HOST/USER/SSH_KEY），
不传时行为与现状完全一致（只发 EC2）。workflow 的 Deploy 拆成 EC2（前）+
Ali（后，if:always + continue-on-error，影子目标失败不挡线上）。deploy-server
的 ali 分支只换二进制 + reload 独立 nginx（listen 443），不启动 jiu（阿里 DB
为只读从库，切流提升为主后才起）。新增 deploy/nginx-jiu-ali.conf 并打进
configs.tar.gz。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

scripts/ci/deploy-site.sh

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
-# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to EC2
-# (/opt/jiu/marketing). Does NOT restart the backend or touch nginx.
+# deploy-site.sh <tag>  —  deploy the Eleventy marketing site to /opt/jiu/marketing.
+# Does NOT restart the backend or touch nginx. Target is EC2 by default; set
+# DEPLOY_HOST/DEPLOY_USER/DEPLOY_SSH_KEY to retarget the Ali box (migration).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
 . "$(dirname "$0")/lib-forgejo.sh"
 
 TAG="$1"
-echo "==> deploy-site: tag=${TAG}"
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+echo "==> deploy-site: tag=${TAG} host=${TARGET_HOST}"
 
 if [ ! -f dist/marketing.tar.gz ]; then
   download_release_assets "$TAG"
@@ -21,11 +24,11 @@ mkdir -p /tmp/jiu-marketing-new
 tar -xzf dist/marketing.tar.gz -C /tmp/jiu-marketing-new
 
 setup_ssh
-echo "==> deploy-site: uploading marketing site to EC2"
+echo "==> deploy-site: uploading marketing site to ${TARGET_HOST}"
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
-  /tmp/jiu-marketing-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-marketing-new/"
+  /tmp/jiu-marketing-new/ "${TARGET_USER}@${TARGET_HOST}:/tmp/jiu-marketing-new/"
 
-${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
+${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 mkdir -p /opt/jiu/marketing
 rsync -a --delete /tmp/jiu-marketing-new/ /opt/jiu/marketing/