feat(ci): 官网 site-v* 构建+部署脚本(compile-site/deploy-site/lib-ssh/workflow)

- scripts/ci/compile-site.sh: node:20 容器内构建 web/website(Astro),
  SITE_URL 注入 canonical 域名 https://pangolin.yanmeiai.com。
- scripts/ci/lib-ssh.sh: 新增共享 setup_ssh/teardown_ssh(写临时私钥+
  known_hosts),供 site 与后续 server 部署复用;目标写死 IP 103.119.13.48
  (runner 无法解析用户本机 ~/.ssh/config 的 pangolin1 别名)。
- scripts/ci/deploy-site.sh: rsync dist/ 到 pangolin1
  /var/www/pangolin-site/,root 部署。
- .gitea/workflows/deploy-site.yml: site-v* tag + workflow_dispatch 触发,
  concurrency 组 deploy-site 防并发。
- .gitea/workflows/ci.yml: shellcheck 列表纳入三个新脚本。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/ci.yml

@@ -47,7 +47,10 @@ jobs:
             -S warning \
               /mnt/scripts/ci/_env.sh \
               /mnt/scripts/ci/lib-forgejo.sh \
-              /mnt/scripts/ci/notify.sh
+              /mnt/scripts/ci/notify.sh \
+              /mnt/scripts/ci/lib-ssh.sh \
+              /mnt/scripts/ci/compile-site.sh \
+              /mnt/scripts/ci/deploy-site.sh
 
   # ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
   openapi-check:

.gitea/workflows/deploy-site.yml

@@ -0,0 +1,29 @@
+name: Deploy Site
+
+on:
+  push:
+    tags:
+      - 'site-v[0-9]*.[0-9]*.[0-9]*'
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-site
+  cancel-in-progress: false
+
+jobs:
+  deploy-site:
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile (Astro 官网, node:20 容器内构建)
+        run: |
+          docker run --rm -v "$PWD:/w" -w /w \
+            -e SITE_URL=https://pangolin.yanmeiai.com \
+            node:20 bash scripts/ci/compile-site.sh
+
+      - name: Deploy → pangolin1
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: bash scripts/ci/deploy-site.sh