feat(deploy): gencode 纳入 server 发版产物 + EC2 生码封装

server 流水线编译并发布 jiu-gencode 二进制（回滚路径随 release 资产
自动下载），部署到 /opt/jiu/backend/，对旧版回滚做存在性判断优雅跳过。
新增 deploy/jiu-gencode.sh 封装自动读 production.env，线上生码从此
一条 ssh 即可，无需本地交叉编译 + scp。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2Wdwo7SmgBJU37cBrkhPK

deploy/jiu-gencode.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# jiu-gencode.sh — 平台方在 EC2 上批量生成兑换券（激活码）的便捷封装。
+#
+# 自动读取 /opt/jiu/config/production.env 的数据库连接，调用同目录的
+# jiu-gencode 二进制写入码池 license_codes。随 server 发版部署到
+# /opt/jiu/backend/，无需再本地交叉编译 + scp。
+#
+# 远程一行用法（在你的 Mac 上）：
+#   ssh -i ~/.ssh/wangjia.pem ec2-user@18.136.60.128 \
+#     '/opt/jiu/backend/jiu-gencode.sh -type annual -days 365 -count 100 -batch 2026-summer'
+#   ssh -i ~/.ssh/wangjia.pem ec2-user@18.136.60.128 \
+#     '/opt/jiu/backend/jiu-gencode.sh -type trial -days 7 -count 1'
+#
+# 参数透传给 jiu-gencode：-type trial|monthly|annual|lifetime  -days N(0=永久)
+#   -devices N(0=不改门店现值)  -count N  -batch <批次>  -note <备注>
+set -euo pipefail
+
+ENV_FILE="${JIU_ENV_FILE:-/opt/jiu/config/production.env}"
+BIN="$(dirname "$0")/jiu-gencode"
+
+[ -f "$ENV_FILE" ] || { echo "jiu-gencode: 找不到环境文件 $ENV_FILE" >&2; exit 1; }
+[ -x "$BIN" ]      || { echo "jiu-gencode: 找不到可执行文件 $BIN" >&2; exit 1; }
+
+# 加载 production.env：跳过注释/空行，逐行 export（不回显，避免泄漏密钥）。
+while IFS= read -r line; do
+  case "$line" in \#*|'') continue ;; esac
+  export "$line"
+done < "$ENV_FILE"
+
+exec "$BIN" "$@"

scripts/ci/compile-backend.sh

@@ -13,10 +13,14 @@ echo "==> compile-backend: tag=${TAG}"
 # Build Go backend (linux/amd64 for EC2)
 cd backend
 GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-server .
+# Platform code-minting CLI (gencode) ships alongside the server so codes can be
+# minted on EC2 without cross-compiling/scp each time.
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-gencode ./cmd/gencode
 cd ..
 
 mkdir -p dist
 mv backend/jiu-server dist/jiu-server
+mv backend/jiu-gencode dist/jiu-gencode
 
 # Shared infrastructure (nginx/systemd/env/compose). version.yaml is NOT here —
 # it belongs to the client pipeline.
@@ -26,7 +30,8 @@ tar -czf dist/configs.tar.gz \
   deploy/production.env.template \
   deploy/setup-ec2.sh \
   deploy/docker-compose.yml \
-  deploy/docker-compose.jiu.yml
+  deploy/docker-compose.jiu.yml \
+  deploy/jiu-gencode.sh
 
 echo "==> compile-backend: done — dist/ contents:"
 ls -lh dist/

scripts/ci/deploy-server.sh

@@ -27,6 +27,13 @@ echo "==> deploy-server: uploading files to EC2"
 ${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
 ${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
 
+# Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
+# release — upload only when present).
+if [ -f dist/jiu-gencode ]; then
+  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
+  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
+fi
+
 ${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
 set -e
 
@@ -35,6 +42,17 @@ sudo systemctl stop jiu
 cp /tmp/jiu-server /opt/jiu/backend/jiu-server
 chmod +x /opt/jiu/backend/jiu-server
 
+# Refresh the code-minting CLI if shipped in this release (skip gracefully on
+# rollback to a pre-gencode release). Not a service — just a host-side binary.
+if [ -f /tmp/jiu-gencode ]; then
+  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
+  chmod +x /opt/jiu/backend/jiu-gencode
+  if [ -f /tmp/jiu-gencode.sh ]; then
+    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
+    chmod +x /opt/jiu/backend/jiu-gencode.sh
+  fi
+fi
+
 # Start and health check
 sudo systemctl start jiu
 echo "Waiting for health check..."

scripts/ci/release-server.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # release-server.sh <tag>  —  create the Forgejo Release for the backend pipeline
-# and upload jiu-server + configs.tar.gz.
+# and upload jiu-server + jiu-gencode + configs.tar.gz.
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
@@ -20,6 +20,7 @@ PYEOF
 
 create_release "$TAG" "$BODY"
 upload_asset dist/jiu-server
+upload_asset dist/jiu-gencode
 upload_asset dist/configs.tar.gz
 
 echo "==> release-server: done — Release ${TAG} created"