Phase 0: 容器化数据面 + CI/CD 自动部署

- deploy/: Xray VLESS+REALITY (11443, 经宿主 nginx SNI 分流) + sing-box Hysteria2 (UDP 443) docker-compose
- 幂等 deploy.sh / gen-secrets.sh / print-clients.sh;受限 nginx-apply 特权脚本 + 一次性 root-setup
- .gitea/workflows/deploy.yml: NAS runner 经 SSH 远程部署到 EC2
- docs/ plan/: 设计方案与实施计划

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/singbox/config.tmpl.json

@@ -0,0 +1,24 @@
+{
+  "log": { "level": "warn", "timestamp": true },
+  "inbounds": [
+    {
+      "type": "hysteria2",
+      "tag": "hy2-in",
+      "listen": "::",
+      "listen_port": 443,
+      "users": [
+        { "name": "phase0", "password": "__HY2_PASSWORD__" }
+      ],
+      "masquerade": "https://www.bing.com",
+      "tls": {
+        "enabled": true,
+        "alpn": ["h3"],
+        "certificate_path": "/etc/sing-box/cert/hy2.crt",
+        "key_path": "/etc/sing-box/cert/hy2.key"
+      }
+    }
+  ],
+  "outbounds": [
+    { "type": "direct", "tag": "direct" }
+  ]
+}