devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

.gitea/workflows/seed.yml

@@ -21,15 +21,14 @@ jobs:
       - name: Setup SSH
         run: |
           mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
+          printf '%s' "${{ secrets.ALI_SSH_KEY }}" > ~/.ssh/ec2_deploy.pem
           chmod 600 ~/.ssh/ec2_deploy.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+          ssh-keyscan -H ${{ secrets.ALI_HOST }} >> ~/.ssh/known_hosts
 
       - name: Seed databases
         env:
-          EC2_HOST: ${{ secrets.EC2_HOST }}
-          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+          EC2_HOST: ${{ secrets.ALI_HOST }}
+          EC2_USER: ${{ secrets.ALI_USER }}
           SHOPS: ${{ github.event.inputs.shops }}
           CLEAR: ${{ github.event.inputs.clear }}
         run: |
@@ -41,7 +40,7 @@ jobs:
               echo "  清空 ${SHOP}..."
               printf "SET @shop_code='%s';\n" "$SHOP" | cat - backend/seeds/clear_shop.sql | \
                 ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-                  "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db"
+                  "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'"
             done
             echo "✓ 清空完成"
           fi
@@ -56,7 +55,7 @@ jobs:
             fi
             echo "→ Seeding $SHOP ..."
             ssh -i ~/.ssh/ec2_deploy.pem ${EC2_USER}@${EC2_HOST} \
-              "docker exec -i jiu_mysql mysql -uroot -p${DB_PASSWORD} --default-character-set=utf8mb4 jiu_db" \
+              "docker exec -i jiu_mysql sh -c 'exec mysql -uroot -p\$MYSQL_ROOT_PASSWORD --default-character-set=utf8mb4 jiu_db'" \
               < "$FILE"
             echo "✓ $SHOP done"
           done