edge 容器自带证书续期(certbot in nginx 镜像)

- edge 改为自定义镜像:官方 nginx + certbot + dns-cloudflare 插件
- pangolin-entrypoint.sh:后台每12h certbot renew,续期后本容器内 nginx -s reload
- 不再需要宿主 cron / docker socket / 独立 certbot 服务做日常续期
- /etc/letsencrypt 改 rw 挂载,挂入 cloudflare.ini
- compose 去掉 build:(宿主 docker-compose 不支持 compose build),改脚本 docker build
- deploy.sh/cutover.sh: docker build -t pangolin-edge:local 后再 up

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/scripts/cutover.sh

@@ -35,6 +35,7 @@ rollback() {
 echo "==> [2/4] 停用宿主 nginx 并起 edge 容器(交接窗口,秒级)"
 systemctl stop nginx
 systemctl disable nginx 2>/dev/null || true
+docker build -t pangolin-edge:local ./edge || { echo "    edge 镜像构建失败" >&2; rollback; }
 if ! docker-compose -p pangolin up -d edge singbox; then
   echo "    edge 启动失败" >&2; rollback
 fi

deploy/scripts/deploy.sh

@@ -36,8 +36,9 @@ if systemctl is-active --quiet nginx 2>/dev/null; then
   echo "    宿主 nginx 仍在运行 → 仅校验 edge 配置,不启动(切换请跑 cutover.sh)"
   edge_validate && echo "    edge 配置校验通过 ✅"
 else
-  echo "    宿主 nginx 未运行 → 拉起 edge"
+  echo "    宿主 nginx 未运行 → 构建并拉起 edge"
   edge_validate
+  docker build -t pangolin-edge:local ./edge
   docker-compose -p pangolin up -d edge
   docker-compose -p pangolin ps edge
 fi