chore(deploy): 成品部署链路、依赖分组与运维基建

部署方式：服务器不再接收源码、不执行构建，改为本地构建成品后交付
- deploy-artifacts.sh：构建→备份→校验→原子替换，支持回滚、镜像/备份轮转、
  mysql 与 postgres 双变体镜像；后端以 docker save|ssh|docker load 交付
- 依赖分组：requirements/{base,storage}.txt + db/{mysql,postgres,sqlite}.txt，
  镜像按所选数据库只装对应驱动（MySQL 变体 565MB → 521MB）

编排与运行时加固
- compose：MySQL/Redis/backend 端口仅绑 127.0.0.1；密钥（SECRET_KEY、
  DATA_ENCRYPTION_KEY、DATA_ENCRYPTION_OLD_KEYS）、PROD_CORS_ORIGINS、
  FORWARDED_ALLOW_IPS、DEMO_ENABLE 一律由 docker/.env 注入
- Dockerfile：对齐依赖分组、以非 root(uid=1000) 运行；.dockerignore 排除全部真实 .env.*
- nginx：静态资源长缓存、隐藏文件拒绝、接口文档仅内网可访问、放行 ACME http-01 校验路径

工程基建
- 新增 CI：backend（uv sync + ruff + pytest）与 frontend（web type-check+vitest、app type-check）
- 新增 DEPLOYMENT.md 运维手册（部署/回滚/密钥轮换/每日巡检/证书/排查）

backend/uv.lock

@@ -184,12 +184,10 @@ source = { virtual = "." }
 dependencies = [
     { name = "agno" },
     { name = "aiofiles" },
-    { name = "aiomysql" },
     { name = "aiosqlite" },
     { name = "alembic" },
     { name = "alibabacloud-oss-v2" },
     { name = "apscheduler" },
-    { name = "asyncpg" },
     { name = "bleach" },
     { name = "boto3" },
     { name = "click" },
@@ -206,12 +204,10 @@ dependencies = [
     { name = "openpyxl" },
     { name = "paramiko" },
     { name = "psutil" },
-    { name = "psycopg", extra = ["binary"] },
     { name = "py-ip2region" },
     { name = "pydantic", extra = ["email"] },
     { name = "pydantic-settings" },
     { name = "pyjwt" },
-    { name = "pymysql" },
     { name = "python-multipart" },
     { name = "redis" },
     { name = "rich" },
@@ -225,11 +221,20 @@ dependencies = [
 ]
 
 [package.optional-dependencies]
+all-db = [
+    { name = "aiomysql" },
+    { name = "aiosqlite" },
+    { name = "asyncpg" },
+    { name = "psycopg", extra = ["binary"] },
+    { name = "pymysql" },
+]
 mysql = [
     { name = "aiomysql" },
+    { name = "pymysql" },
 ]
 postgres = [
     { name = "asyncpg" },
+    { name = "psycopg", extra = ["binary"] },
 ]
 sqlite = [
     { name = "aiosqlite" },
@@ -247,14 +252,15 @@ dev = [
 requires-dist = [
     { name = "agno", specifier = "==2.5.8" },
     { name = "aiofiles", specifier = "==24.1.0" },
-    { name = "aiomysql", specifier = ">=0.2.0" },
+    { name = "aiomysql", marker = "extra == 'all-db'", specifier = ">=0.2.0" },
     { name = "aiomysql", marker = "extra == 'mysql'", specifier = ">=0.2.0" },
     { name = "aiosqlite", specifier = "==0.22.1" },
+    { name = "aiosqlite", marker = "extra == 'all-db'", specifier = "==0.22.1" },
     { name = "aiosqlite", marker = "extra == 'sqlite'", specifier = "==0.22.1" },
     { name = "alembic", specifier = "==1.18.4" },
     { name = "alibabacloud-oss-v2", specifier = "==1.3.2" },
     { name = "apscheduler", specifier = "==3.11.0" },
-    { name = "asyncpg", specifier = "==0.31.0" },
+    { name = "asyncpg", marker = "extra == 'all-db'", specifier = "==0.31.0" },
     { name = "asyncpg", marker = "extra == 'postgres'", specifier = "==0.31.0" },
     { name = "bleach", specifier = "==6.4.0" },
     { name = "boto3", specifier = "==1.43.72" },
@@ -272,12 +278,14 @@ requires-dist = [
     { name = "openpyxl", specifier = "==3.1.5" },
     { name = "paramiko", specifier = "==5.0.0" },
     { name = "psutil", specifier = "==7.2.2" },
-    { name = "psycopg", extras = ["binary"], specifier = "==3.3.2" },
+    { name = "psycopg", extras = ["binary"], marker = "extra == 'all-db'", specifier = "==3.3.2" },
+    { name = "psycopg", extras = ["binary"], marker = "extra == 'postgres'", specifier = "==3.3.2" },
     { name = "py-ip2region", specifier = "==3.0.4" },
     { name = "pydantic", extras = ["email"], specifier = ">=2.12.5" },
     { name = "pydantic-settings", specifier = ">=2.6.1,<3" },
     { name = "pyjwt", specifier = "==2.13.0" },
-    { name = "pymysql", specifier = "==1.2.0" },
+    { name = "pymysql", marker = "extra == 'all-db'", specifier = "==1.2.0" },
+    { name = "pymysql", marker = "extra == 'mysql'", specifier = "==1.2.0" },
     { name = "python-multipart", specifier = "==0.0.32" },
     { name = "redis", specifier = "==7.1.0" },
     { name = "rich", specifier = "==15.0.0" },
@@ -289,7 +297,7 @@ requires-dist = [
     { name = "uvicorn", specifier = "==0.49.0" },
     { name = "websockets", specifier = ">=16.0,<17.0" },
 ]
-provides-extras = ["mysql", "postgres", "sqlite"]
+provides-extras = ["mysql", "postgres", "sqlite", "all-db"]
 
 [package.metadata.requires-dev]
 dev = [