devops: 备案通过回切 https 域名 + 流水线 Ali 单轨

- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、
  ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除
- 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/
  release-client/notify）
- 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、
  seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret）

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o

scripts/ci/deploy-server.sh

@@ -8,7 +8,7 @@
 # is decommissioned — deploying there would resurrect a backend against a stale
 # database, so the workflow no longer calls the ec2 branch):
 #   - ali: stop jiu → swap binary → start jiu → health check (:8081) →
-#          reload the host nginx (transition listen-8443 config).
+#          reload the host nginx (443 ssl jiu.51yanmei.com, 备案回切 2026-07-03).
 #   - ec2 (legacy default, kept for manual rollback of pre-cutover tags only):
 #          stop jiu → swap binary → start jiu → health check → reload nginx
 #          inside the pangolin-edge container.
@@ -56,7 +56,7 @@ fi
 if [ "$DEPLOY_TARGET" = "ali" ]; then
   # --- Alibaba Cloud (live primary since the 2026-07-02 cutover) ---
   # Full swap-and-restart: jiu.service runs against the promoted local primary
-  # DB on :8081; nginx serves the transition listen-8443 config.
+  # DB on :8081; nginx serves 443 ssl (jiu.51yanmei.com, 备案回切 2026-07-03).
   ${SSH} "${TARGET_USER}@${TARGET_HOST}" << 'ENDSSH'
 set -e