Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -0,0 +1,28 @@
+# Pangolin Phase-0 数据面:Xray(VLESS+REALITY) + sing-box(Hysteria2)
+# 独立 project 名 pangolin,与现网 marzban/blog/jiu 完全隔离。
+# 镜像固定版本,避免 latest 漂移(EC2 实测:Xray 26.3.27 / sing-box 1.13.12)。
+name: pangolin
+
+services:
+  xray:
+    image: ghcr.io/xtls/xray-core:26.3.27
+    container_name: pangolin-xray
+    restart: unless-stopped
+    # 仅监听本地 11443,由宿主 nginx 的 ssl_preread 按 SNI(www.apple.com)转入
+    ports:
+      - "127.0.0.1:11443:11443"
+    volumes:
+      - ./xray/config.json:/etc/xray/config.json:ro
+    command: ["run", "-c", "/etc/xray/config.json"]
+
+  singbox:
+    image: ghcr.io/sagernet/sing-box:v1.13.12
+    container_name: pangolin-singbox
+    restart: unless-stopped
+    # Hysteria2 直接对外暴露 UDP 443(与 TCP 443 不同协议栈,互不冲突)
+    ports:
+      - "443:443/udp"
+    volumes:
+      - ./singbox/config.json:/etc/sing-box/config.json:ro
+      - ./secrets/hy2:/etc/sing-box/cert:ro
+    command: ["run", "-c", "/etc/sing-box/config.json"]