让七月迭代具备可直接部署的配置基线

补齐三套环境配置、测试环境部署门禁与 system_config 初始化，并按当前无企微应用的约束将企微凭据改为明文存储。

Constraint: 当前测试环境尚无企微应用及历史企微密文数据

Rejected: 使用启动环境变量加密企微凭据 | 用户明确要求直接明文保存并移除加密密钥

Confidence: high

Scope-risk: moderate

Directive: 企微真实闭环完成前保持两个旧审批入口开关为 true

Tested: gofmt；git diff --check；bash -n；docker compose config；Gitea workflow YAML 解析；OpenAPI 重新生成

Not-tested: go test；常规 go build；LSP；实际数据库迁移；真实测试环境部署；企微真实联调

.gitea/workflows/deploy.yaml

@@ -66,6 +66,14 @@ jobs:
         run: |
           # 确保部署目录存在（仅需日志目录，配置已嵌入二进制文件）
           mkdir -p ${{ env.DEPLOY_DIR }}/logs
+
+          umask 077
+          {
+            printf 'JUNHONG_APPROVAL_LEGACY_REFUND_MANUAL_ENABLED=true\n'
+            printf 'JUNHONG_APPROVAL_LEGACY_OFFLINE_RECHARGE_PAY_ENABLED=true\n'
+            printf 'JUNHONG_WORKER_ROLE=all\n'
+            printf 'JUNHONG_WORKER_INSTANCE_NAME=test-worker-all-1\n'
+          } > ${{ env.DEPLOY_DIR }}/.env
           
           # 强制更新 docker-compose.prod.yml（确保使用最新配置）
           echo "📋 更新部署配置文件..."
@@ -77,10 +85,33 @@ jobs:
           docker compose -f docker-compose.prod.yml pull
           
           echo "🚀 重启服务..."
-          docker compose -f docker-compose.prod.yml up -d
+          docker compose -f docker-compose.prod.yml up -d --remove-orphans
           
-          echo "⏳ 等待服务启动..."
-          sleep 10
+          echo "⏳ 等待 API 健康检查通过..."
+          for i in $(seq 1 30); do
+            API_HEALTH=$(docker inspect junhong-cmp-api --format='{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' 2>/dev/null || true)
+            if [ "$API_HEALTH" = "healthy" ]; then
+              break
+            fi
+            if [ "$i" -eq 30 ]; then
+              echo "❌ API 在等待窗口内未恢复健康"
+              docker compose -f docker-compose.prod.yml logs api --tail=200
+              exit 1
+            fi
+            sleep 2
+          done
+
+          echo "🔎 校验 Worker 与数据库迁移版本..."
+          if [ "$(docker inspect junhong-cmp-worker --format='{{.State.Running}}' 2>/dev/null || true)" != "true" ]; then
+            echo "❌ Worker 未运行"
+            docker compose -f docker-compose.prod.yml logs worker --tail=200
+            exit 1
+          fi
+          docker exec junhong-cmp-api sh -c '
+            DB_URL="postgresql://${JUNHONG_DATABASE_USER}:${JUNHONG_DATABASE_PASSWORD}@${JUNHONG_DATABASE_HOST}:${JUNHONG_DATABASE_PORT}/${JUNHONG_DATABASE_DBNAME}?sslmode=${JUNHONG_DATABASE_SSLMODE}"
+            migrate -path /app/migrations -database "$DB_URL" version
+          '
+          docker compose -f docker-compose.prod.yml logs worker --tail=80
           
           echo "✅ 部署完成！"
           docker compose -f docker-compose.prod.yml ps