Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -11,3 +11,12 @@
 *.app
 .snapshots/*
 
+# 密钥与渲染产物 —— 绝不入库
+deploy/secrets/
+deploy/xray/config.json
+deploy/singbox/config.json
+
+# 杂项
+.DS_Store
+*.log
+*.bak