feat(server): 试运行部署与运营基线（E13/E14/E17/E19/E20/E21）

- 增加 deploy/trialrun：Docker Compose + env 模板 + runbook + 发布/回滚 checklist - 新增 DB/文件存储备份恢复脚本（backup/restore） - 新增 system.users 运营接口：创建/启用禁用/重置密码/分配角色 + 审计 - 新增 seed:trialrun 引导管理员账号（一次性口令） - 补齐 SIGTERM/SIGINT 优雅停机（关闭 job/HTTP/DB）
2026-02-09 01:12:49 +08:00
@@ -0,0 +1,102 @@
+version: "3.8"
+
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: hyb-oa-trialrun-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    ports:
+      - "5432:5432"
+    volumes:
+      - ./data/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  server:
+    build:
+      context: ../..
+      dockerfile: deploy/trialrun/Dockerfile
+    container_name: hyb-oa-trialrun-server
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      NODE_ENV: production
+      APP_ORIGIN: ${APP_ORIGIN}
+      JWT_SECRET: ${JWT_SECRET}
+      DATABASE_URL: ${DATABASE_URL}
+      STORAGE_DIR: ${STORAGE_DIR}
+      HOST: ${HOST}
+      PORT: ${PORT}
+      COOKIE_SECURE: ${COOKIE_SECURE}
+      SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
+      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
+
+      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED}
+      RATE_LIMIT_LOGIN_MAX: ${RATE_LIMIT_LOGIN_MAX}
+      RATE_LIMIT_LOGIN_WINDOW: ${RATE_LIMIT_LOGIN_WINDOW}
+
+      OCR_PROVIDER: ${OCR_PROVIDER}
+      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
+      OCR_POLL_CRON: ${OCR_POLL_CRON}
+      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
+      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
+      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
+      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
+      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
+      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
+
+      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
+    ports:
+      - "3000:3000"
+    volumes:
+      - ./data/storage:${STORAGE_DIR}
+
+  init:
+    build:
+      context: ../..
+      dockerfile: deploy/trialrun/Dockerfile
+    container_name: hyb-oa-trialrun-init
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      NODE_ENV: production
+      APP_ORIGIN: ${APP_ORIGIN}
+      JWT_SECRET: ${JWT_SECRET}
+      DATABASE_URL: ${DATABASE_URL}
+      STORAGE_DIR: ${STORAGE_DIR}
+      SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
+      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
+      OCR_PROVIDER: ${OCR_PROVIDER}
+      OCR_POLL_CRON: ${OCR_POLL_CRON}
+      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
+      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
+      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
+      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
+      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
+      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
+      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
+      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
+
+      TRIALRUN_ADMIN_EMAIL: ${TRIALRUN_ADMIN_EMAIL}
+      TRIALRUN_ADMIN_PHONE: ${TRIALRUN_ADMIN_PHONE}
+      TRIALRUN_ADMIN_PASSWORD: ${TRIALRUN_ADMIN_PASSWORD}
+    volumes:
+      - ./data/storage:${STORAGE_DIR}
+    entrypoint: ["sh", "-c"]
+    command: >
+      "cd /app/server
+      && npm run prisma:migrate:deploy
+      && npm run seed:config
+      && npm run seed:trialrun"
+    restart: "no"
+