chore(deploy): 删除 EC2 部署栈,转向 RackNerd 自建节点栈

EC2(marzban 共存)分发面不再由本仓库管理,全面转向新 VPS 自建。删除:
- deploy/{edge,singbox,xray,certbot,backup,scripts,docker-compose.yml,.env.example,README.md}
- .gitea/workflows/deploy.yml(EC2 自动部署 CD)
- ci/nginx-test.sh(edge nginx 校验)
保留 deploy/{bootstrap,single-node}(新节点初始化 + 全套自建)。

ci.yml 去掉 EC2 相关 job(compose/nginx 校验、edge 镜像构建),
shellcheck 改为校验 bootstrap/single-node 脚本;openapi/脱敏/flutter 不变。
deadman-watch 的"EC2"特指改为"任意常在线主机"。

注:EC2 上正在跑的服务不受影响(仅本仓库不再管理它)。文档(CLAUDE.md、
docs/回滚手册.md、app/kernel/poc/README.md)仍引用旧栈,待单独更新。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,6 +1,6 @@
 name: ci-pangolin
 
-# 触发条件:deploy/ 或 design/ 或 ci/ 变更时，以及所有向 main 的 PR
+# 触发条件:deploy/ 或 design/ 或 client/ 或 ci/ 变更时，以及所有向 main 的 PR
 on:
   push:
     branches: [main]
@@ -24,40 +24,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: shellcheck deploy/scripts/*.sh
+      - name: shellcheck 节点脚本(bootstrap + single-node)
         run: |
           docker run --rm \
             -v "$PWD/deploy:/mnt/deploy:ro" \
             koalaman/shellcheck:stable \
             shellcheck -S warning \
-              /mnt/deploy/scripts/gen-secrets.sh \
-              /mnt/deploy/scripts/print-clients.sh \
-              /mnt/deploy/scripts/deploy.sh \
-              /mnt/deploy/scripts/cutover.sh \
-              /mnt/deploy/scripts/rollback.sh
+              /mnt/deploy/bootstrap/init.sh \
+              /mnt/deploy/bootstrap/monitor/pangolin-monitor.sh \
+              /mnt/deploy/bootstrap/monitor/deadman-watch.sh \
+              /mnt/deploy/single-node/deploy.sh
 
-      - name: shellcheck deploy/edge/pangolin-entrypoint.sh
-        run: |
-          docker run --rm \
-            -v "$PWD/deploy/edge:/mnt/edge:ro" \
-            koalaman/shellcheck:stable \
-            shellcheck -S warning /mnt/edge/pangolin-entrypoint.sh
-
-  # ── Job 2: Unit Tests ────────────────────────────────────────────────────
-  unit-test:
-    name: Unit Tests — nginx cfg + compose
-    runs-on: nas
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: validate docker-compose.yml (syntax)
-        run: docker-compose -f deploy/docker-compose.yml config -q
-
-      - name: nginx config lint with stub certs
-        run: bash ci/nginx-test.sh
-
-  # ── Job 3: OpenAPI Sync Check ────────────────────────────────────────────
+  # ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
   openapi-check:
     name: OpenAPI Sync Check
     runs-on: nas
@@ -74,7 +52,7 @@ jobs:
             sh -c "pip install openapi-spec-validator --quiet && \
                    python -m openapi_spec_validator /spec/openapi.yaml"
 
-  # ── Job 4: Redline Word Scan (脱敏) ──────────────────────────────────────
+  # ── Job 3: Redline Word Scan (脱敏) ──────────────────────────────────────
   redline-scan:
     name: Redline Scan — 脱敏 (UI 文案)
     runs-on: nas
@@ -85,9 +63,7 @@ jobs:
       - name: scan UI text resources for prohibited words
         run: bash ci/scan-redline.sh
 
-  # ── Job 5: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
-  # golden 基准图需本地 `flutter test --update-goldens` 生成并提交后,
-  # 再把 test/golden 纳入下方测试范围;此处先跑 unit + widget,保证 CI 稳定。
+  # ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
   flutter-client:
     name: Flutter — analyze + test
     runs-on: nas
@@ -101,14 +77,3 @@ jobs:
             -v "$PWD/client:/app" -w /app \
             ghcr.io/cirruslabs/flutter:stable \
             bash -c "flutter pub get && flutter analyze && flutter test test/unit test/widget"
-
-  # ── Job 6: Container Image Build ────────────────────────────────────────
-  image-build:
-    name: Image Build — pangolin-edge
-    runs-on: nas
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: build pangolin-edge:ci
-        run: docker build -t pangolin-edge:ci ./deploy/edge

.gitea/workflows/deploy.yml

@@ -1,46 +0,0 @@
-name: deploy-pangolin
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'deploy/**'
-      - '.gitea/workflows/deploy.yml'
-  workflow_dispatch:
-
-jobs:
-  deploy:
-    # ⚠️ 改成你 NAS 上 act_runner 的实际 label(Gitea→Settings→Actions→Runners)
-    runs-on: nas
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Ensure ssh/rsync
-        run: |
-          if ! command -v rsync >/dev/null || ! command -v ssh >/dev/null; then
-            (command -v apt-get >/dev/null && apt-get update -y && apt-get install -y openssh-client rsync) \
-            || (command -v apk >/dev/null && apk add --no-cache openssh-client rsync)
-          fi
-
-      - name: SSH 私钥(指向 EC2)
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_key
-          chmod 600 ~/.ssh/ec2_key
-          ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
-
-      - name: 同步 deploy/ 到 EC2(保留 secrets)
-        run: |
-          rsync -az \
-            --exclude 'secrets' \
-            --exclude 'singbox/config.json' \
-            --exclude 'xray/config.json' \
-            -e "ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new" \
-            deploy/ "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:pangolin/"
-
-      - name: 远程部署(免 root,幂等)
-        run: |
-          ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new \
-            "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}" \
-            "export CF_API_TOKEN='${{ secrets.CF_API_TOKEN }}'; cd ~/pangolin && chmod +x scripts/*.sh && ./scripts/deploy.sh"