feat(devops): macOS 构建接入 Developer ID 签名 + 公证

- compile-macos.sh：flutter build 后 codesign（hardened runtime + timestamp
  + Release.entitlements）→ notarytool 公证（复用 App Store Connect API key）
  → stapler staple → 重新打包，产出已签名+公证+stapled 的 .app
- 强制策略：缺 MACOS_DEVELOPER_ID_CERT_P12_BASE64 / APPSTORE_API_KEY_P8_BASE64
  时在 flutter build 前 fail-fast，绝不产出未签名包
- deploy-client.yml：build-macos 步骤注入证书与 API key secrets
- 新增 docs/macos-signing.md：Developer ID Application 证书创建与 secret 配置

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-client.yml

@@ -46,6 +46,12 @@ jobs:
         run: sh scripts/ci/provision-mac.sh
 
       - name: Compile (Flutter macOS)
+        env:
+          MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }}
+          MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }}
+          APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }}
+          APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }}
+          APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }}
         run: sh scripts/ci/compile-macos.sh "${{ gitea.ref_name }}"
 
       - name: Upload macos artifacts