fix(ci): 对 Forgejo API 的 curl 加 -k，跳过自签名证书验证

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/ci/deploy.sh

@@ -14,13 +14,17 @@ if [ ! -f dist/jiu-server ] || [ ! -f dist/web.tar.gz ] || [ ! -f dist/configs.t
   echo "==> deploy: dist/ incomplete — downloading assets for ${TAG} from Forgejo"
   mkdir -p dist
 
-  curl -f \
+  curl -kf \
     -H "Authorization: token ${FORGEJO_TOKEN}" \
     "${FORGEJO_URL}/api/v1/repos/${GITEA_REPOSITORY}/releases/tags/${TAG}" \
     -o /tmp/release-info.json
 
   python3 - <<'PYEOF'
-import json, urllib.request, os, sys
+import json, urllib.request, ssl, os, sys
+
+ctx = ssl.create_default_context()
+ctx.check_hostname = False
+ctx.verify_mode = ssl.CERT_NONE
 
 with open('/tmp/release-info.json') as f:
     release = json.load(f)
@@ -33,7 +37,7 @@ release_id = release['id']
 for asset in release.get('assets', []):
     url = f"{forgejo_url}/api/v1/repos/{repo}/releases/{release_id}/assets/{asset['id']}"
     req = urllib.request.Request(url, headers={'Authorization': f'token {token}'})
-    with urllib.request.urlopen(req) as resp:
+    with urllib.request.urlopen(req, context=ctx) as resp:
         with open(f"dist/{asset['name']}", 'wb') as out:
             out.write(resp.read())
     print(f"Downloaded: {asset['name']}")