ci: 打 v* tag 自动发版到 ali（Gitea Actions）

新增 Gitea Actions 流水线，复刻本地 deploy.sh 到 CI，打 v* tag 即自动发版：
- .gitea/workflows/deploy.yml：v*.*.* tag 触发 → go test → 交叉编译 linux/amd64
  → 传 ali → 备份 payd.bak → 切换 → systemctl restart pay → 探活（失败自动回滚）
- .gitea/workflows/checks.yml：PR/合并 main 跑 go vet+build+test 静态闸
- scripts/ci/deploy.sh：本地 deploy.sh 的 CI 版（从 secret 注入部署私钥 + 主机，
  不用 ~/.ssh 的 ali 别名）；notify.sh：Telegram 通知（secrets 未配则静默跳过）
- runs-on mac，复用 jiu 的自建 runner；业务密钥仍走 ali /etc/pay/pay.env
- README 部署段补 CI 路径 + 所需 secrets（ALI_SSH_KEY/ALI_HOST/ALI_USER）

首次需在 pay 仓 Gitea → Settings → Actions → Secrets 配 3 个 ALI_* secret。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019UQmqWmV67sXGLrb3U1XXn

.gitea/workflows/checks.yml

@@ -0,0 +1,35 @@
+name: Checks
+
+# PR 与合并 main 时跑 Go 静态闸（vet + build + test），发版前先绿。
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: checks-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  go:
+    runs-on: mac
+    env:
+      GOPROXY: https://goproxy.cn,direct
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: go vet
+        run: |
+          export PATH="/opt/homebrew/bin:$PATH"
+          go vet ./...
+
+      - name: go build
+        run: |
+          export PATH="/opt/homebrew/bin:$PATH"
+          go build ./...
+
+      - name: go test
+        run: |
+          export PATH="/opt/homebrew/bin:$PATH"
+          go test ./...

.gitea/workflows/deploy.yml

@@ -0,0 +1,41 @@
+name: Deploy
+
+# 打 v* tag 即自动发版到 ali（单 Go 二进制 payd，systemd 服务 pay，:8080/health）。
+#   git tag v1.0.2 && git push origin v1.0.2
+# runs-on: mac —— 复用 jiu 的自建 mac runner（已注册、装了 go）。
+on:
+  push:
+    tags:
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+
+concurrency:
+  group: deploy-pay
+  cancel-in-progress: false
+
+jobs:
+  release-deploy:
+    runs-on: mac
+    env:
+      GOPROXY: https://goproxy.cn,direct
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test (go test)
+        run: |
+          export PATH="/opt/homebrew/bin:$PATH"
+          go test ./...
+
+      - name: Deploy → Ali（交叉编译 + 传 + 备份 + 重启 + 探活/回滚）
+        env:
+          DEPLOY_HOST: ${{ secrets.ALI_HOST }}
+          DEPLOY_USER: ${{ secrets.ALI_USER }}
+          DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
+        run: sh scripts/ci/deploy.sh "${{ gitea.ref_name }}"
+
+      - name: Notify
+        if: always()
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: sh scripts/ci/notify.sh "${{ gitea.ref_name }}" "${{ job.status }}"