feat(devops): 发版拆分为 client/site/server 三条独立流水线

将单一 CI/CD 流水线拆成三条互不影响的发布流水线，各有 tag 前缀、独立版本
序列与独立 CHANGELOG：

- client（client-v*）：Flutter 全平台 + version.yaml 自更新清单
- site（site-v*）：web/ Eleventy 营销站，不含 web 版 app
- server（server-v*）：backend Go 服务 + 共享基建 nginx/systemd

新增 3 个 workflow（deploy-client/site/server.yml）替换 deploy.yml；CI 脚本
按 part 拆分为 compile-/release-/deploy-{client,site,server}.sh，抽出公共函数
lib-forgejo.sh；compile-{macos,android,ios,windows}.sh 改去 client-v 前缀；
manual.yml 按前缀路由回滚。

跨流水线解耦：version.yaml 归 client，后端每请求实时读取（不重启、不触发
server 流水线）；官网下载页的版本徽章/下载链接/更新日志时间线运行时经
/api/v1/public/release 动态拉取（API 不可达回退构建时静态内容）。为此一次性
扩展后端 changelog 字段（version.go/public.go）与 download.njk 动态渲染。

CHANGELOG.md 重命名为 CHANGELOG-client.md，新增 CHANGELOG-site/server.md；
重写 /release 命令为 /release <part> [version]；同步更新 CLAUDE.md 与部署文档。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/deploy-client.yml

@@ -1,12 +1,16 @@
-name: Deploy
+name: Deploy Client
 
 on:
   push:
     tags:
-      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'client-v[0-9]*.[0-9]*.[0-9]*'
+
+concurrency:
+  group: deploy-client
+  cancel-in-progress: false
 
 jobs:
-  build-linux-web:
+  build-client-web:
     runs-on: mac
     env:
       GOPROXY: https://goproxy.cn,direct
@@ -19,19 +23,17 @@ jobs:
       - name: Provision (idempotent — auto-runs if host not initialized)
         run: sh scripts/ci/provision-mac.sh
 
-      - name: Compile (Linux backend + Flutter Web)
-        run: sh scripts/ci/compile.sh "${{ gitea.ref_name }}"
+      - name: Compile (Flutter Web)
+        run: sh scripts/ci/compile-client-web.sh "${{ gitea.ref_name }}"
 
-      - name: Upload linux-web artifacts
+      - name: Upload web artifacts
         uses: actions/upload-artifact@v3
         with:
-          name: linux-web
+          name: client-web
           path: dist/
 
   build-macos:
-    # Same physical runner as build-linux-web (label: mac, capacity 1). Run them
-    # serially via needs so the second job doesn't sit queued and time out.
-    needs: build-linux-web
+    needs: build-client-web
     runs-on: mac
     env:
       PUB_HOSTED_URL: https://pub.flutter-io.cn
@@ -53,9 +55,6 @@ jobs:
           path: dist/
 
   build-android:
-    # Same physical mac runner (label: mac, capacity 1) — it already has the
-    # Android SDK. Serialize after build-macos via needs so it doesn't sit
-    # queued and time out.
     needs: build-macos
     runs-on: mac
     env:
@@ -83,10 +82,6 @@ jobs:
           path: dist/
 
   build-ios:
-    # Same physical mac runner (label: mac, capacity 1) with Xcode. Serialize
-    # after build-android. Builds a signed IPA and uploads to TestFlight; if the
-    # iOS signing secrets are absent the script skips gracefully (exit 0), so this
-    # job is safe to keep before the Apple Developer account is configured.
     needs: build-android
     runs-on: mac
     env:
@@ -134,8 +129,8 @@ jobs:
           name: windows
           path: dist/
 
-  release-deploy:
-    needs: [build-linux-web, build-macos, build-android, build-ios, build-windows]
+  release-deploy-client:
+    needs: [build-client-web, build-macos, build-android, build-ios, build-windows]
     runs-on: mac
     env:
       GOPROXY: https://goproxy.cn,direct
@@ -145,10 +140,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Download linux-web artifacts
+      - name: Download web artifacts
         uses: actions/download-artifact@v3
         with:
-          name: linux-web
+          name: client-web
           path: dist/
 
       - name: Download macos artifacts
@@ -169,15 +164,15 @@ jobs:
           name: windows
           path: dist/
 
-      - name: Test
-        run: sh scripts/ci/test.sh
+      - name: Test (flutter analyze)
+        run: sh scripts/ci/test.sh client
 
       - name: Release
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
           GITEA_REPOSITORY: ${{ gitea.repository }}
-        run: sh scripts/ci/release.sh "${{ gitea.ref_name }}"
+        run: sh scripts/ci/release-client.sh "${{ gitea.ref_name }}"
 
       - name: Deploy
         env:
@@ -187,7 +182,7 @@ jobs:
           EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
           EC2_HOST: ${{ secrets.EC2_HOST }}
           EC2_USER: ${{ secrets.EC2_USER }}
-        run: sh scripts/ci/deploy.sh "${{ gitea.ref_name }}"
+        run: sh scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
 
       - name: Notify
         if: always()

.gitea/workflows/deploy-server.yml

@@ -0,0 +1,54 @@
+name: Deploy Server
+
+on:
+  push:
+    tags:
+      - 'server-v[0-9]*.[0-9]*.[0-9]*'
+
+concurrency:
+  group: deploy-server
+  cancel-in-progress: false
+
+jobs:
+  release-deploy-server:
+    runs-on: mac
+    env:
+      GOPROXY: https://goproxy.cn,direct
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Provision (idempotent — auto-runs if host not initialized)
+        run: sh scripts/ci/provision-mac.sh
+
+      - name: Compile (Linux backend + configs)
+        run: sh scripts/ci/compile-backend.sh "${{ gitea.ref_name }}"
+
+      - name: Test (go test)
+        run: sh scripts/ci/test.sh server
+
+      - name: Release
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+        run: sh scripts/ci/release-server.sh "${{ gitea.ref_name }}"
+
+      - name: Deploy
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
+          EC2_HOST: ${{ secrets.EC2_HOST }}
+          EC2_USER: ${{ secrets.EC2_USER }}
+        run: sh scripts/ci/deploy-server.sh "${{ gitea.ref_name }}"
+
+      - name: Notify
+        if: always()
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"

.gitea/workflows/deploy-site.yml

@@ -0,0 +1,50 @@
+name: Deploy Site
+
+on:
+  push:
+    tags:
+      - 'site-v[0-9]*.[0-9]*.[0-9]*'
+
+concurrency:
+  group: deploy-site
+  cancel-in-progress: false
+
+jobs:
+  release-deploy-site:
+    runs-on: mac
+    env:
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Provision (idempotent — auto-runs if host not initialized)
+        run: sh scripts/ci/provision-mac.sh
+
+      - name: Compile (Eleventy marketing site)
+        run: sh scripts/ci/compile-site.sh "${{ gitea.ref_name }}"
+
+      - name: Release
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+        run: sh scripts/ci/release-site.sh "${{ gitea.ref_name }}"
+
+      - name: Deploy
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
+          EC2_HOST: ${{ secrets.EC2_HOST }}
+          EC2_USER: ${{ secrets.EC2_USER }}
+        run: sh scripts/ci/deploy-site.sh "${{ gitea.ref_name }}"
+
+      - name: Notify
+        if: always()
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"

.gitea/workflows/manual.yml

@@ -1,10 +1,16 @@
 name: Manual Deploy
 
+# Re-deploy a previously released tag. The tag prefix selects which part:
+#   client-v*  -> deploy-client.sh   (web app + installers + version.yaml)
+#   site-v*    -> deploy-site.sh     (marketing site)
+#   server-v*  -> deploy-server.sh   (backend binary + nginx)
+# Each deploy script downloads its assets from the matching Forgejo Release.
+
 on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Tag to deploy (e.g. v1.0.0)'
+        description: 'Prefixed tag to deploy (e.g. client-v1.0.55 / site-v1.0.0 / server-v1.0.0)'
         required: true
         type: string
 
@@ -17,7 +23,7 @@ jobs:
         with:
           ref: ${{ inputs.version }}
 
-      - name: Deploy
+      - name: Deploy (routed by tag prefix)
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
@@ -25,4 +31,18 @@ jobs:
           EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
           EC2_HOST: ${{ secrets.EC2_HOST }}
           EC2_USER: ${{ secrets.EC2_USER }}
-        run: sh scripts/ci/deploy.sh "${{ inputs.version }}"
+        run: |
+          TAG="${{ inputs.version }}"
+          case "$TAG" in
+            client-v*) sh scripts/ci/deploy-client.sh "$TAG" ;;
+            site-v*)   sh scripts/ci/deploy-site.sh   "$TAG" ;;
+            server-v*) sh scripts/ci/deploy-server.sh "$TAG" ;;
+            *) echo "Unknown tag prefix: $TAG (expected client-v* / site-v* / server-v*)" >&2; exit 1 ;;
+          esac
+
+      - name: Notify
+        if: always()
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: sh scripts/ci/notify.sh "${{ inputs.version }}" "${{ job.status }}"