devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

scripts/ci/backup-db.sh

@@ -1,10 +1,12 @@
 #!/usr/bin/env bash
-# backup-db.sh — dump the production MySQL (jiu_db) from EC2 and keep a gzip
-# snapshot on the mac (host) runner's local disk (~/jiu-db-backups), retaining
-# the last 30 days. The DB password is read on EC2 from production.env's
-# DATABASE_DSN, so no DB-password secret is needed.
+# backup-db.sh — dump the production MySQL (jiu_db) from the production host
+# and keep a gzip snapshot on the mac (host) runner's local disk
+# (~/jiu-db-backups), retaining the last 30 days. The DB password is read on
+# the host from production.env's DATABASE_DSN, so no DB-password secret is
+# needed.
 #
-# Requires env (same as deploy-server): EC2_SSH_KEY, EC2_HOST, EC2_USER.
+# Target host (post-cutover 2026-07-03: Ali is the primary): pass
+# DEPLOY_SSH_KEY / DEPLOY_HOST / DEPLOY_USER (falls back to EC2_* legacy vars).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
@@ -15,15 +17,18 @@ mkdir -p "${BACKUP_DIR}"
 FILENAME="jiu_db_$(date +%Y%m%d_%H%M%S).sql.gz"
 DEST="${BACKUP_DIR}/${FILENAME}"
 
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+
 setup_ssh
 trap teardown_ssh EXIT
 
-echo "==> backup-db: dumping jiu_db from ${EC2_HOST}"
-# On EC2: parse the DSN password from production.env, then mysqldump the
+echo "==> backup-db: dumping jiu_db from ${TARGET_HOST}"
+# On the host: parse the DSN password from production.env, then mysqldump the
 # container to stdout; stream back over ssh and gzip locally. The heredoc is
-# single-quoted, so it runs verbatim on EC2 (no local expansion). ${SSH} carries
+# single-quoted, so it runs verbatim on the host (no local expansion). ${SSH} carries
 # no -t, keeping stdout a clean dump stream.
-${SSH} "${EC2_USER}@${EC2_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
+${SSH} "${TARGET_USER}@${TARGET_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
 set -euo pipefail
 PW=$(python3 -c 'import re;e=open("/opt/jiu/config/production.env").read();d=re.search(r"DATABASE_DSN=(.*)",e).group(1).strip().strip(chr(34)).strip(chr(39));print(re.match(r"[^:]+:([^@]+)@",d).group(1))')
 exec docker exec -e MYSQL_PWD="${PW}" jiu_mysql mysqldump -uroot --single-transaction --no-tablespaces jiu_db

scripts/ci/deploy-server.sh

@@ -8,7 +8,7 @@
 # is decommissioned — deploying there would resurrect a backend against a stale
 # database, so the workflow no longer calls the ec2 branch):
 #   - ali: stop jiu → swap binary → start jiu → health check (:8081) →
-#          reload the host nginx (transition listen-8443 config).
+#          reload the host nginx (443 ssl jiu.51yanmei.com, 备案回切 2026-07-03).
 #   - ec2 (legacy default, kept for manual rollback of pre-cutover tags only):
 #          stop jiu → swap binary → start jiu → health check → reload nginx
 #          inside the pangolin-edge container.
@@ -56,7 +56,7 @@ fi
 if [ "$DEPLOY_TARGET" = "ali" ]; then
   # --- Alibaba Cloud (live primary since the 2026-07-02 cutover) ---
   # Full swap-and-restart: jiu.service runs against the promoted local primary
-  # DB on :8081; nginx serves the transition listen-8443 config.
+  # DB on :8081; nginx serves 443 ssl (jiu.51yanmei.com, 备案回切 2026-07-03).
   ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e
 

scripts/ci/notify.sh

@@ -14,7 +14,7 @@ else
 fi
 
 MSG="${ICON} 岩美 ${TAG} ${LABEL}
-https://jiu.51yanmei.com"
+https://jiu.51yanmei.com"  # 2026-07-03 备案通过，正式域名入口
 
 curl -f -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
   -d "chat_id=${TELEGRAM_CHAT_ID}" \

scripts/ci/release-client.sh

@@ -28,7 +28,7 @@ ver            = sys.argv[1]
 notes          = sys.argv[2]
 changelog_file = sys.argv[3]
 
-base = "https://jiu.51yanmei.com/downloads"
+base = "https://jiu.51yanmei.com/downloads"  # 2026-07-03 备案通过回切 https 域名
 mac_url     = f"{base}/jiu-macos-x64.zip"
 win_url     = f"{base}/jiu-windows-x64-setup.exe"
 android_url = f"{base}/jiu-android.apk"

scripts/local_test.sh

@@ -5,7 +5,8 @@
 #   sh scripts/local_test.sh            # 编译 + 启动
 #   sh scripts/local_test.sh --no-open  # 只编译不启动
 #
-# 后端固定指向生产 https://jiu.51yanmei.com（与 CI compile-macos.sh 一致）。
+# 后端固定指向生产 https://jiu.51yanmei.com（与 CI compile-macos.sh 一致；
+# 2026-07-03 备案通过已回切 https 域名）。
 set -euo pipefail
 
 export PATH="/opt/homebrew/bin:$PATH"