chore(deploy): CI 双轨——发版同时部署 EC2 + 阿里（EC2→Ali 迁移期）

deploy-{server,site,client}.sh 目标主机参数化（DEPLOY_HOST/USER/SSH_KEY），
不传时行为与现状完全一致（只发 EC2）。workflow 的 Deploy 拆成 EC2（前）+
Ali（后，if:always + continue-on-error，影子目标失败不挡线上）。deploy-server
的 ali 分支只换二进制 + reload 独立 nginx（listen 443），不启动 jiu（阿里 DB
为只读从库，切流提升为主后才起）。新增 deploy/nginx-jiu-ali.conf 并打进
configs.tar.gz。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx

scripts/ci/lib-forgejo.sh

@@ -106,12 +106,17 @@ for a in rel.get('assets', []):
 PYEOF
 }
 
-# setup_ssh — write the EC2 deploy key and export SSH / SCP commands.
+# setup_ssh — write the deploy key and export SSH / SCP commands.
+# Target is the EC2 host by default; set DEPLOY_HOST / DEPLOY_USER / DEPLOY_SSH_KEY
+# to retarget another host (e.g. the Alibaba Cloud box during the EC2→Ali migration).
+# Backward-compatible: with no DEPLOY_* set, behaves exactly as before (EC2).
 setup_ssh() {
+  local host="${DEPLOY_HOST:-$EC2_HOST}"
+  local key="${DEPLOY_SSH_KEY:-$EC2_SSH_KEY}"
   mkdir -p ~/.ssh
-  printf '%s' "${EC2_SSH_KEY}" > ~/.ssh/ec2_deploy.pem
+  printf '%s' "${key}" > ~/.ssh/ec2_deploy.pem
   chmod 600 ~/.ssh/ec2_deploy.pem
-  ssh-keyscan -H "${EC2_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+  ssh-keyscan -H "${host}" >> ~/.ssh/known_hosts 2>/dev/null
   SSH="ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no"
   SCP="scp -O -i ~/.ssh/ec2_deploy.pem"
 }