devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

.gitea/workflows/reset-db.yml

@@ -17,20 +17,19 @@ jobs:
       - name: Setup SSH
         run: |
           mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
+          printf '%s' "${{ secrets.ALI_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
           chmod 600 ~/.ssh/ec2_deploy.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.ALI_HOST }} >> ~/.ssh/known_hosts
 
       - name: Reset database & reseed
         env:
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
           SHOPS: ${{ github.event.inputs.shops }}
         run: |
           # 1. 清库重建
           ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-            "docker exec jiu_mysql mysql -uroot -p${DB_PASSWORD} -e 'DROP DATABASE IF EXISTS jiu_db; CREATE DATABASE jiu_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;'"
+            "docker exec jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD -e \"DROP DATABASE IF EXISTS jiu_db; CREATE DATABASE jiu_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"'"
           echo "✓ Database reset"
 
           # 2. 重启 jiu-server，AutoMigrate 重建表结构
@@ -57,13 +56,13 @@ jobs:
             echo "→ Seeding $SHOP ..."
             if [ "$FIRST" = "true" ]; then
               ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db" \
+                "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'" \
                 < "$FILE"
               FIRST=false
             else
               grep -v "^TRUNCATE" "$FILE" | \
                 ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db"
+                "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'"
             fi
             echo "✓ $SHOP done"
           done