feat: CI 流水线 — lint + 单测 + OpenAPI 校验 + 脱敏扫描 + 镜像构建 [tsk_P5b5nIrEsfrV]

新增 .gitea/workflows/ci.yml 五个 Job：
  1. lint        — shellcheck -S warning 扫描全部 deploy/ shell 脚本
  2. unit-test   — docker-compose config 语法校验 + nginx -t（桩证书）
  3. openapi-check — openapi-spec-validator 验证 design/server/openapi.yaml
  4. redline-scan  — ci/scan-redline.sh 扫描 UI 文案红线词（design/ jsx/dart/html）
  5. image-build   — docker build pangolin-edge:ci

附带：
  - ci/scan-redline.sh：脱敏扫描脚本，过滤注释行与外部渠道 handle
  - ci/nginx-test.sh：自签桩证书 + nginx -t，CI 免依赖真实 Let's Encrypt
  - design/server/openapi.yaml：依据 ARCHITECTURE.md §3 展开的 OAS 3.0 完整契约
  - dparts.jsx / parts.jsx：修复 killSwitchSub EN 文案「the VPN drops」红线词
    → 改为「connection drops」（行为描述，不提产品类别）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,96 @@
+name: ci-pangolin
+
+# 触发条件:deploy/ 或 design/ 或 ci/ 变更时，以及所有向 main 的 PR
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'deploy/**'
+      - 'design/**'
+      - 'ci/**'
+      - '.gitea/workflows/ci.yml'
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+
+  # ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
+  lint:
+    name: Lint — shellcheck
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: shellcheck deploy/scripts/*.sh
+        run: |
+          docker run --rm \
+            -v "$PWD/deploy:/mnt/deploy:ro" \
+            koalaman/shellcheck:stable \
+            shellcheck -S warning \
+              /mnt/deploy/scripts/gen-secrets.sh \
+              /mnt/deploy/scripts/print-clients.sh \
+              /mnt/deploy/scripts/deploy.sh \
+              /mnt/deploy/scripts/cutover.sh \
+              /mnt/deploy/scripts/rollback.sh
+
+      - name: shellcheck deploy/edge/pangolin-entrypoint.sh
+        run: |
+          docker run --rm \
+            -v "$PWD/deploy/edge:/mnt/edge:ro" \
+            koalaman/shellcheck:stable \
+            shellcheck -S warning /mnt/edge/pangolin-entrypoint.sh
+
+  # ── Job 2: Unit Tests ────────────────────────────────────────────────────
+  unit-test:
+    name: Unit Tests — nginx cfg + compose
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: validate docker-compose.yml (syntax)
+        run: docker-compose -f deploy/docker-compose.yml config -q
+
+      - name: nginx config lint with stub certs
+        run: bash ci/nginx-test.sh
+
+  # ── Job 3: OpenAPI Sync Check ────────────────────────────────────────────
+  openapi-check:
+    name: OpenAPI Sync Check
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
+      - name: lint design/server/openapi.yaml
+        run: |
+          docker run --rm \
+            -v "$PWD/design/server:/spec:ro" \
+            python:3.12-alpine \
+            sh -c "pip install openapi-spec-validator --quiet && \
+                   python -m openapi_spec_validator /spec/openapi.yaml"
+
+  # ── Job 4: Redline Word Scan (脱敏) ──────────────────────────────────────
+  redline-scan:
+    name: Redline Scan — 脱敏 (UI 文案)
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: scan UI text resources for prohibited words
+        run: bash ci/scan-redline.sh
+
+  # ── Job 5: Container Image Build ────────────────────────────────────────
+  image-build:
+    name: Image Build — pangolin-edge
+    runs-on: nas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: build pangolin-edge:ci
+        run: docker build -t pangolin-edge:ci ./deploy/edge