diff --git a/.gitea/workflows/deploy-client.yml b/.gitea/workflows/deploy-client.yml
index 3d4b3f5..106e6fb 100644
--- a/.gitea/workflows/deploy-client.yml
+++ b/.gitea/workflows/deploy-client.yml
@@ -6,20 +6,14 @@ name: Deploy Client
# intentionally DECOUPLED — see the "why build-macos/build-ios don't block"
# note above the build-macos job below for the mechanism and rationale.
#
-# TODO(controller) — RUNNER AVAILABILITY: per docs/ci-runner.md, pangolin
-# currently has exactly ONE registered Gitea Actions runner
-# ("mac-pangolin-2", label `nas:host`). Neither `runs-on: mac` nor
-# `runs-on: windows` below has any runner registered to pick it up yet — this
-# workflow will queue forever until that's fixed. Options: (a) register
-# mac-pangolin-2 with an additional `mac` label (it's already a mac host —
-# cheapest fix for build-android/release-deploy) and separately stand up +
-# register an actual Windows host runner labeled `windows` for build-windows
-# (no such machine exists per docs/ci-runner.md), or (b) repoint both at
-# `nas` and accept that Android/Windows builds then compete with the
-# docker-in-domain nas jobs on the same single mac host. This mirrors the
-# `runs-on: mac` / `runs-on: windows` split already planned in
-# docs/superpowers/plans/2026-07-05-cicd.md Task 7/10 — written that way here
-# for fidelity to that plan, NOT because the runners are confirmed to exist.
+# RUNNER 就绪(2026-09-07 起,过时 TODO 已删):用户级 mac runner(label `mac`)+
+# windows runner(label `windows`)均已注册(单一真相源见 baize ci_runners)。
+# runs-on: mac / windows 正常派工,不再无限排队。
+#
+# WEB 已并入本工作流(deploy-web job,构建 usercenter+website → Cloudflare Pages)——
+# 一个 `client-v*` tag 即发 **web + iOS/mac/Android/Windows**(对齐 jiu 的
+# deploy-client)。仅发 web 仍可用独立的 site-v* / deploy-site.yml(逻辑同源,共用
+# scripts/ci/{compile-site,compile-usercenter,combine-site,deploy-site}.sh)。
on:
push:
tags:
@@ -177,6 +171,30 @@ jobs:
# No artifact upload — compile-ios.sh uploads straight to TestFlight via
# altool (matches jiu); nothing is produced under dist/ for this job.
+ # WEB(用户中心 usercenter + 官网 website → Cloudflare Pages):并入本工作流,使
+ # 一个 client-v* tag 同时发 web + 四客户端平台(对齐 jiu 的 build-client-web)。
+ # 与 deploy-site.yml 同源(共用 scripts/ci/{compile-site,compile-usercenter,
+ # combine-site,deploy-site}.sh);web 直接自部署到 CF Pages,不产 dist/ 产物、
+ # 不进 release-deploy 的 artifact 下载。ubuntu-latest = 家里 nas act_runner。
+ deploy-web:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ - name: Compile (Astro 官网)
+ env:
+ SITE_URL: https://pangolin.yanmeiai.com
+ run: bash scripts/ci/compile-site.sh
+ - name: Compile (用户中心 Next.js)
+ run: bash scripts/ci/compile-usercenter.sh
+ - name: Combine (官网 + 用户中心)
+ run: bash scripts/ci/combine-site.sh
+ - name: Deploy → Cloudflare Pages
+ env:
+ CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+ CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+ run: bash scripts/ci/deploy-site.sh
+
# release-deploy 发布策略:needs 全部四平台(等它们**完成**,不抢跑),但用
# `if` 让 mac/ios/windows 的失败不 skip 本 job —— 只要 android(稳定 floor)成功即发。
# 背景:build-macos/ios 必须跑在 mac runner,其 Checkout(git fetch git.51yanmei.com)
@@ -187,7 +205,7 @@ jobs:
# · continue-on-error 在 gitea 里**不**让下游 needs 在失败时继续(会 skip),故必须
# 配 `if: always() && needs.build-android.result=='success'` 才能「等全部、失败不阻」。
release-deploy:
- needs: [build-android, build-windows, build-macos, build-ios]
+ needs: [build-android, build-windows, build-macos, build-ios, deploy-web]
if: ${{ always() && needs.build-android.result == 'success' }}
# ubuntu-latest = 家里 nas act_runner,与 gitea 同机/同网:Release → Forgejo 的
# API 调用走本地不过 frps 隧道(mac runner 走 git.51yanmei.com→frps→抖,curl 超时
diff --git a/client/ios/Runner/Info.plist b/client/ios/Runner/Info.plist
index ba703ee..b062098 100644
--- a/client/ios/Runner/Info.plist
+++ b/client/ios/Runner/Info.plist
@@ -51,5 +51,10 @@
⚠️ 红线词规范：避免 VPN/翻墙 等词，使用「网络加速」口径 -->
NSVPNUsageDescription
Pangolin 使用网络加速通道为您的连接提供安全保护。
+
+ ITSAppUsesNonExemptEncryption
+