feat(deploy): 单节点全套部署脚本 deploy/single-node（档 3 真机准备）

一台全新 Ubuntu/Debian VPS 上一条命令起整套 pangolin：MySQL + Redis（docker）
+ 控制面（HTTP + gRPC agent 服务）+ 节点 agent + sing-box 数据面，客户端连该
VPS 公网 IP 真实出网。

- deploy.sh：幂等编排——构建二进制 → docker MySQL/Redis → 生成 JWT/webhook/
  derive 密钥 + Node CA + CA 签发的 gRPC server 证书（SAN localhost，匹配 agent
  enroll 后的 mTLS 校验）+ REALITY 密钥对（持久化跨重部署）→ migrate + seed 节点
  → 起控制面（走完整 gRPC 分支）→ nodectl bootstrap-token → 起 agent + sing-box。
- systemd/{pangolin-server,pangolin-agent,sing-box}.service、docker-compose.yml
  （MySQL/Redis 仅 loopback）、seed-node.sql.tmpl。
- README.md：架构图 + 部署/验证步骤 + 客户端接线（API URL / PANGOLIN_SINGBOX_BIN
  / sudoers / 真节点 uuid，客户端代码无改动）+ 排查指引。

本机验证：shellcheck + bash -n 通过；openssl CA ↔ mtls.NewCA + gRPC 证书链互通
已单测实测通过。VPS 端到端（出口 IP == VPS IP）待真机到位后执行。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/single-node/systemd/pangolin-agent.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Pangolin node agent (self-enrolls, manages local sing-box)
+Documentation=https://github.com/wangjia/pangolin
+After=network-online.target pangolin-server.service
+Wants=network-online.target
+Requires=pangolin-server.service
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/pangolin-agent/agent.env
+ExecStart=/usr/local/bin/pangolin-agent
+Restart=on-failure
+RestartSec=5
+# The agent calls `systemctl restart sing-box` after rendering config.
+User=root
+
+[Install]
+WantedBy=multi-user.target

deploy/single-node/systemd/pangolin-server.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Pangolin control plane (HTTP API + gRPC agent server)
+Documentation=https://github.com/wangjia/pangolin
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/pangolin/server.env
+ExecStart=/usr/local/bin/pangolin-server
+Restart=on-failure
+RestartSec=3
+# Control plane holds JWT/CA keys; keep them owner-only.
+UMask=0077
+User=root
+
+[Install]
+WantedBy=multi-user.target

deploy/single-node/systemd/sing-box.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=sing-box data plane (pangolin node server)
+Documentation=https://sing-box.sagernet.org
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Config is rendered by pangolin-agent; this unit may fail-restart until the
+# agent's first Register populates /etc/sing-box/config.json — that is expected
+# on a fresh box and self-heals once the agent enrolls.
+ExecStart=/usr/local/bin/sing-box run -c /etc/sing-box/config.json
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=1048576
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
+User=root
+
+[Install]
+WantedBy=multi-user.target