feat(server): 装配 notices(路由替换空壳+reward/pay 注入)+ 发版联动插 version 公告

main.go 挂载 notices.Store/Handler:注入 rewardSvc/payWebhook 到账通知钩子,
/v1/notices 路由由 accountAPI 空壳换成真实 List/MarkRead,删除 account.go
的 TODO 空壳方法。补齐 pangolin-nodectl 到编译/部署产物链
(compile-backend.sh + deploy-server.sh),release-client.sh 在
version.yaml 推送成功后追加一步用 nodectl 插入 version 类型站内公告
(失败不阻断发版)。

scripts/ci/compile-backend.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # compile-backend.sh — cross-compile the pangolin Go control-plane binaries
-# (server / agent / migrate) for the pangolin1 deploy target. CGO disabled:
-# modernc.org/sqlite is pure Go, no cgo toolchain needed on the runner.
-# Output: server/out/{pangolin-server,pangolin-agent,pangolin-migrate}.
+# (server / agent / migrate / nodectl) for the pangolin1 deploy target. CGO
+# disabled: modernc.org/sqlite is pure Go, no cgo toolchain needed on the
+# runner.
+# Output: server/out/{pangolin-server,pangolin-agent,pangolin-migrate,pangolin-nodectl}.
 #
 # Run inside a golang:1.25 container by .gitea/workflows/deploy-server.yml;
 # this script itself just runs `go build` and assumes it is invoked from the
@@ -24,5 +25,8 @@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out/pangolin-agent ./cmd/agent
 echo "==> compile-backend: building pangolin-migrate"
 CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out/pangolin-migrate ./cmd/migrate
 
+echo "==> compile-backend: building pangolin-nodectl"
+CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o out/pangolin-nodectl ./cmd/nodectl
+
 echo "==> compile-backend: done — out/ contents:"
 ls -lh out/

scripts/ci/deploy-server.sh

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
 # deploy-server.sh <tag> — deploy the pangolin control-plane binaries
-# (pangolin-server / pangolin-agent / pangolin-migrate) to pangolin1, in the
-# exact manual sequence used for F3/F4: stop → wal checkpoint → backup db →
-# migrate (rollback db + restart old binary on failure) → swap binaries →
-# start → healthcheck. Assumes compile-backend.sh has already produced
-# server/out/{pangolin-server,pangolin-agent,pangolin-migrate}.
+# (pangolin-server / pangolin-agent / pangolin-migrate / pangolin-nodectl) to
+# pangolin1, in the exact manual sequence used for F3/F4: stop → wal
+# checkpoint → backup db → migrate (rollback db + restart old binary on
+# failure) → swap binaries → start → healthcheck. Assumes compile-backend.sh
+# has already produced
+# server/out/{pangolin-server,pangolin-agent,pangolin-migrate,pangolin-nodectl}.
 #
 # Usage: scripts/ci/deploy-server.sh <tag>   (e.g. server-v1.2.3)
 # Requires env: DEPLOY_SSH_KEY (see lib-ssh.sh).
@@ -36,7 +37,7 @@ SCP="scp -i ${SSH_KEY_FILE} -P ${DEPLOY_PORT} -o StrictHostKeyChecking=accept-ne
 
 echo "==> deploy-server: tag=${TAG} host=${DEPLOY_HOST}"
 echo "==> deploy-server: uploading binaries to ${DEPLOY_HOST}:/tmp/"
-$SCP server/out/pangolin-server server/out/pangolin-agent server/out/pangolin-migrate "root@${DEPLOY_HOST}:/tmp/"
+$SCP server/out/pangolin-server server/out/pangolin-agent server/out/pangolin-migrate server/out/pangolin-nodectl "root@${DEPLOY_HOST}:/tmp/"
 
 $SSH "root@${DEPLOY_HOST}" "bash -s" <<REMOTE
 set -euo pipefail
@@ -50,6 +51,7 @@ cp -p "$BIN/pangolin-server" "$BIN/pangolin-server.bak-$TAG" || true
 install -m755 /tmp/pangolin-server "$BIN/pangolin-server"
 install -m755 /tmp/pangolin-agent  "$BIN/pangolin-agent"
 install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate"
+install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl"
 systemctl start pangolin-server
 systemctl is-active pangolin-server
 REMOTE

scripts/ci/release-client.sh

@@ -103,6 +103,15 @@ if [ -f "$MANIFEST_TMPL" ]; then
     $SCP "$MANIFEST_OUT" "root@${DEPLOY_HOST}:/tmp/pangolin_version.yaml.new"
     $SSH "root@${DEPLOY_HOST}" "mv /tmp/pangolin_version.yaml.new /etc/pangolin/version.yaml && chown pangolin:pangolin /etc/pangolin/version.yaml && chmod 644 /etc/pangolin/version.yaml"
     echo "==> release-client: version.yaml deployed to pangolin1 (/etc/pangolin/version.yaml)"
+
+    # 站内通知:插一条 version 类型公告,提示用户有新版可更新。失败不阻断发版
+    # (公告只是锦上添花,manifest 已经推送成功才是自动更新真正生效的部分)。
+    echo "==> release-client: inserting version notice via pangolin-nodectl"
+    $SSH "root@${DEPLOY_HOST}" "DB_DSN=/var/lib/pangolin/pangolin.db DB_DRIVER=sqlite \
+      /usr/local/bin/pangolin-nodectl notice add --type version \
+      --title-zh \"v${VER} 已发布\" --title-en \"v${VER} released\" \
+      --body-zh \"新版本已可更新,打开设置检查更新。\" --body-en \"A new version is available — check for updates in Settings.\"" \
+      || echo "==> release-client: version notice 插入失败(不阻断发版)"
   else
     echo "==> release-client: DEPLOY_SSH_KEY not set — skipping live manifest push (dist/version.yaml still staged + uploaded as a release asset)"
   fi