ci(client): web 并入 deploy-client(一个 client-v* 发全平台) + iOS 加密合规键

1) deploy-client.yml 加 deploy-web job(usercenter+website→CF Pages,与
   deploy-site.yml 同源共用 scripts/ci/*.sh),release-deploy needs 带上它:
   一个 client-v* tag 即发 web + iOS/mac/Android/Windows(对齐 jiu)。
   site-v*/deploy-site.yml 保留供 web-only 单发。清理过时 runner TODO 注释
   (mac/windows 用户级 runner 今日已就绪)。
2) iOS Info.plist 加 ITSAppUsesNonExemptEncryption=false(仅标准加密,免
   ASC 每次上传加密合规问答;法务判定需申报再改 true)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD

.gitea/workflows/deploy-client.yml

@@ -6,20 +6,14 @@ name: Deploy Client
 # intentionally DECOUPLED — see the "why build-macos/build-ios don't block"
 # note above the build-macos job below for the mechanism and rationale.
 #
-# TODO(controller) — RUNNER AVAILABILITY: per docs/ci-runner.md, pangolin
-# currently has exactly ONE registered Gitea Actions runner
-# ("mac-pangolin-2", label `nas:host`). Neither `runs-on: mac` nor
-# `runs-on: windows` below has any runner registered to pick it up yet — this
-# workflow will queue forever until that's fixed. Options: (a) register
-# mac-pangolin-2 with an additional `mac` label (it's already a mac host —
-# cheapest fix for build-android/release-deploy) and separately stand up +
-# register an actual Windows host runner labeled `windows` for build-windows
-# (no such machine exists per docs/ci-runner.md), or (b) repoint both at
-# `nas` and accept that Android/Windows builds then compete with the
-# docker-in-domain nas jobs on the same single mac host. This mirrors the
-# `runs-on: mac` / `runs-on: windows` split already planned in
-# docs/superpowers/plans/2026-07-05-cicd.md Task 7/10 — written that way here
-# for fidelity to that plan, NOT because the runners are confirmed to exist.
+# RUNNER 就绪(2026-09-07 起,过时 TODO 已删):用户级 mac runner(label `mac`)+
+# windows runner(label `windows`)均已注册(单一真相源见 baize ci_runners)。
+# runs-on: mac / windows 正常派工,不再无限排队。
+#
+# WEB 已并入本工作流(deploy-web job,构建 usercenter+website → Cloudflare Pages)——
+# 一个 `client-v*` tag 即发 **web + iOS/mac/Android/Windows**(对齐 jiu 的
+# deploy-client)。仅发 web 仍可用独立的 site-v* / deploy-site.yml(逻辑同源,共用
+# scripts/ci/{compile-site,compile-usercenter,combine-site,deploy-site}.sh)。
 on:
   push:
     tags:
@@ -177,6 +171,30 @@ jobs:
       # No artifact upload — compile-ios.sh uploads straight to TestFlight via
       # altool (matches jiu); nothing is produced under dist/ for this job.
 
+  # WEB(用户中心 usercenter + 官网 website → Cloudflare Pages):并入本工作流,使
+  # 一个 client-v* tag 同时发 web + 四客户端平台(对齐 jiu 的 build-client-web)。
+  # 与 deploy-site.yml 同源(共用 scripts/ci/{compile-site,compile-usercenter,
+  # combine-site,deploy-site}.sh);web 直接自部署到 CF Pages,不产 dist/ 产物、
+  # 不进 release-deploy 的 artifact 下载。ubuntu-latest = 家里 nas act_runner。
+  deploy-web:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Compile (Astro 官网)
+        env:
+          SITE_URL: https://pangolin.yanmeiai.com
+        run: bash scripts/ci/compile-site.sh
+      - name: Compile (用户中心 Next.js)
+        run: bash scripts/ci/compile-usercenter.sh
+      - name: Combine (官网 + 用户中心)
+        run: bash scripts/ci/combine-site.sh
+      - name: Deploy → Cloudflare Pages
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: bash scripts/ci/deploy-site.sh
+
   # release-deploy 发布策略:needs 全部四平台(等它们**完成**,不抢跑),但用
   # `if` 让 mac/ios/windows 的失败不 skip 本 job —— 只要 android(稳定 floor)成功即发。
   # 背景:build-macos/ios 必须跑在 mac runner,其 Checkout(git fetch git.51yanmei.com)
@@ -187,7 +205,7 @@ jobs:
   #   · continue-on-error 在 gitea 里**不**让下游 needs 在失败时继续(会 skip),故必须
   #     配 `if: always() && needs.build-android.result=='success'` 才能「等全部、失败不阻」。
   release-deploy:
-    needs: [build-android, build-windows, build-macos, build-ios]
+    needs: [build-android, build-windows, build-macos, build-ios, deploy-web]
     if: ${{ always() && needs.build-android.result == 'success' }}
     # ubuntu-latest = 家里 nas act_runner,与 gitea 同机/同网:Release → Forgejo 的
     # API 调用走本地不过 frps 隧道(mac runner 走 git.51yanmei.com→frps→抖,curl 超时

client/ios/Runner/Info.plist

@@ -51,5 +51,10 @@
 	     ⚠️ 红线词规范：避免 VPN/翻墙 等词，使用「网络加速」口径 -->
 	<key>NSVPNUsageDescription</key>
 	<string>Pangolin 使用网络加速通道为您的连接提供安全保护。</string>
+	<!-- 出口加密合规：仅使用标准加密（TLS/REALITY 基于标准 crypto 原语，无自研加密）
+	     → 声明不含「非豁免加密」，免去 App Store Connect 每次上传的加密合规问答。
+	     ⚠️ 若后续法务判定需正式申报，改 true 并补 ITSEncryptionExportComplianceCode。 -->
+	<key>ITSAppUsesNonExemptEncryption</key>
+	<false/>
 </dict>
 </plist>