fix(infra): pin production web API proxy to production API container

- Add production nginx config that proxies /api to xiaoxia-api-production
- Use production nginx config when building tagged production web artifact
- Prevent production web from resolving shared Docker alias api to staging API

.gitea/workflows/deploy.yml

@@ -152,6 +152,7 @@ jobs:
           docker.m.daocloud.io/library/node:20 \
           sh -lc 'npm ci && npm run build'
         docker build --pull=false \
+          --build-arg NGINX_CONF=infra/docker/nginx.production.conf \
           -f infra/docker/web-artifact.Dockerfile \
           -t "xiaoxia-saas-web:${GITHUB_REF_NAME}" \
           .

infra/docker/nginx.production.conf

@@ -0,0 +1,28 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api/ {
+        proxy_pass http://xiaoxia-api-production:8000/api/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+}