feat(deploy): 单节点全套部署脚本 deploy/single-node（档 3 真机准备）

一台全新 Ubuntu/Debian VPS 上一条命令起整套 pangolin：MySQL + Redis（docker）
+ 控制面（HTTP + gRPC agent 服务）+ 节点 agent + sing-box 数据面，客户端连该
VPS 公网 IP 真实出网。

- deploy.sh：幂等编排——构建二进制 → docker MySQL/Redis → 生成 JWT/webhook/
  derive 密钥 + Node CA + CA 签发的 gRPC server 证书（SAN localhost，匹配 agent
  enroll 后的 mTLS 校验）+ REALITY 密钥对（持久化跨重部署）→ migrate + seed 节点
  → 起控制面（走完整 gRPC 分支）→ nodectl bootstrap-token → 起 agent + sing-box。
- systemd/{pangolin-server,pangolin-agent,sing-box}.service、docker-compose.yml
  （MySQL/Redis 仅 loopback）、seed-node.sql.tmpl。
- README.md：架构图 + 部署/验证步骤 + 客户端接线（API URL / PANGOLIN_SINGBOX_BIN
  / sudoers / 真节点 uuid，客户端代码无改动）+ 排查指引。

本机验证：shellcheck + bash -n 通过；openssl CA ↔ mtls.NewCA + gRPC 证书链互通
已单测实测通过。VPS 端到端（出口 IP == VPS IP）待真机到位后执行。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

todo/todo.json

@@ -1,9 +1,9 @@
 {
   "meta": {
     "title": "doc — 项目 TODO",
-    "updated_at": "2026-06-16T00:50:13.996Z"
+    "updated_at": "2026-06-16T15:22:21.051Z"
   },
-  "seq": 21,
+  "seq": 23,
   "items": [
     {
       "id": 1,
@@ -612,7 +612,7 @@
         "前端",
         "mac"
       ],
-      "status": "open",
+      "status": "done",
       "created_at": "2026-06-15T23:36:58.366Z",
       "done": false,
       "completed_at": null,
@@ -628,11 +628,54 @@
         "前端",
         "mac"
       ],
-      "status": "doing",
+      "status": "done",
       "created_at": "2026-06-16T00:49:45.404Z",
       "done": false,
       "completed_at": null,
       "version": null
+    },
+    {
+      "id": 22,
+      "title": "档2: 接真后端(本机置备 + 客户端去旁路/修keychain)",
+      "desc": "后端/客户端已就绪,只差: dev/ 本机置备(docker MySQL+Redis + JWT密钥 + migrate + seed节点 + run-local.sh) + 客户端修keychain(MacOsOptions useDataProtectionKeyChain:false) + 删dev旁路。验收: mac app 真注册→登录→拉真节点。plan: ~/.claude/plans/majestic-kindling-boole.md",
+      "level": "high",
+      "tier": 1,
+      "tags": [
+        "后端",
+        "前端",
+        "mac",
+        "CI/CD"
+      ],
+      "status": "done",
+      "created_at": "2026-06-16T05:06:43.335Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 23,
+      "title": "档3 真实连接出网：新 VPS 全套部署（代码+部署脚本）",
+      "desc": "nodectl bootstrap-token 子命令 + deploy/single-node 一键部署脚本 + systemd unit；本机编译验证，机器到位端到端测试",
+      "level": "high",
+      "tier": 1,
+      "tags": [
+        "后端",
+        "部署",
+        "CI/CD"
+      ],
+      "status": "doing",
+      "created_at": "2026-06-16T15:22:03.653Z",
+      "done": false,
+      "completed_at": null,
+      "version": null,
+      "gate": {
+        "kind": "plan",
+        "note": "nodectl bootstrap-token 子命令 + deploy/single-node 部署脚本",
+        "ref": "/Users/wangjia/.claude/plans/majestic-kindling-boole.md",
+        "approval": "pending",
+        "proposed_at": "2026-06-16T15:22:20.983Z",
+        "approved_at": null
+      }
     }
   ]
 }