devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

scripts/ci/backup-db.sh

@@ -1,10 +1,12 @@
 #!/usr/bin/env bash
-# backup-db.sh — dump the production MySQL (jiu_db) from EC2 and keep a gzip
-# snapshot on the mac (host) runner's local disk (~/jiu-db-backups), retaining
-# the last 30 days. The DB password is read on EC2 from production.env's
-# DATABASE_DSN, so no DB-password secret is needed.
+# backup-db.sh — dump the production MySQL (jiu_db) from the production host
+# and keep a gzip snapshot on the mac (host) runner's local disk
+# (~/jiu-db-backups), retaining the last 30 days. The DB password is read on
+# the host from production.env's DATABASE_DSN, so no DB-password secret is
+# needed.
 #
-# Requires env (same as deploy-server): EC2_SSH_KEY, EC2_HOST, EC2_USER.
+# Target host (post-cutover 2026-07-03: Ali is the primary): pass
+# DEPLOY_SSH_KEY / DEPLOY_HOST / DEPLOY_USER (falls back to EC2_* legacy vars).
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
@@ -15,15 +17,18 @@ mkdir -p "${BACKUP_DIR}"
 FILENAME="jiu_db_$(date +%Y%m%d_%H%M%S).sql.gz"
 DEST="${BACKUP_DIR}/${FILENAME}"
 
+TARGET_HOST="${DEPLOY_HOST:-$EC2_HOST}"
+TARGET_USER="${DEPLOY_USER:-$EC2_USER}"
+
 setup_ssh
 trap teardown_ssh EXIT
 
-echo "==> backup-db: dumping jiu_db from ${EC2_HOST}"
-# On EC2: parse the DSN password from production.env, then mysqldump the
+echo "==> backup-db: dumping jiu_db from ${TARGET_HOST}"
+# On the host: parse the DSN password from production.env, then mysqldump the
 # container to stdout; stream back over ssh and gzip locally. The heredoc is
-# single-quoted, so it runs verbatim on EC2 (no local expansion). ${SSH} carries
+# single-quoted, so it runs verbatim on the host (no local expansion). ${SSH} carries
 # no -t, keeping stdout a clean dump stream.
-${SSH} "${EC2_USER}@${EC2_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
+${SSH} "${TARGET_USER}@${TARGET_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
 set -euo pipefail
 PW=$(python3 -c 'import re;e=open("/opt/jiu/config/production.env").read();d=re.search(r"DATABASE_DSN=(.*)",e).group(1).strip().strip(chr(34)).strip(chr(39));print(re.match(r"[^:]+:([^@]+)@",d).group(1))')
 exec docker exec -e MYSQL_PWD="${PW}" jiu_mysql mysqldump -uroot --single-transaction --no-tablespaces jiu_db