feat: 标准化部署流程和文档化

- 添加 docs/deployment.md 完整部署文档，包含：
  - 环境要求
  - 首次部署流程
  - 版本更新流程
  - 回滚流程
  - 常见问题排查
  - 环境变量说明

- 添加标准化部署脚本：
  - scripts/deploy_production.sh: 生产环境部署脚本
  - scripts/deploy_staging.sh: 预发布环境部署脚本
  - scripts/rollback.sh: 回滚脚本（支持交互式和命令行模式）

- 完善 infra/docker/compose.yml：
  - 添加详细注释说明
  - 添加资源限制建议（注释）
  - 记录 web volume 挂载的注意事项（避免 403 问题）

- 添加 .github/workflows/release.yml：
  - 完整的发布流程
  - 构建所有三个镜像（api、worker、web）
  - 自动部署到生产环境
  - E2E 测试和 GitHub Release 创建

.github/workflows/release.yml

@@ -1,74 +1,414 @@
-name: Release
+# ===========================================
+# 小虾剪辑 SaaS 发布工作流
+# ===========================================
+#
+# 触发条件:
+#   - 推送 v* 格式的 tag (如 v0.1.5)
+#
+# 完整流程:
+#   1. 构建 API + Worker 镜像
+#   2. 构建 Web 镜像
+#   3. 创建 Release
+#   4. 上传到生产服务器
+#   5. 执行部署
+#   6. 运行 E2E 测试
+#
+# 环境变量:
+#   PRODUCTION_SSH_HOST  - 生产服务器地址
+#   PRODUCTION_SSH_USER - 生产服务器用户名
+#   PRODUCTION_SSH_KEY  - SSH 私钥
+#
+
+name: Release Pipeline
 
 on:
   push:
     tags:
       - 'v*'
 
+env:
+  VERSION: ${ { github.ref_name } }
+
 jobs:
+  # =========================================
+  # Job 1: 构建所有镜像
+  # =========================================
+  build-images:
+    name: Build All Images
+    runs-on: runtime-builder:host
+    container: localhost:5000/xiaoxia-ci-python:3.12
+    
+    outputs:
+      version: ${{ env.VERSION }}
+    
+    steps:
+      # 检出代码
+      - name: Checkout code
+        run: |
+          python - <<'PY'
+          import os
+          import tarfile
+          import urllib.request
+
+          api_url = os.environ['GITHUB_API_URL']
+          repository = os.environ['GITHUB_REPOSITORY']
+          sha = os.environ['GITHUB_SHA']
+          token = os.environ.get('GITHUB_TOKEN', '')
+          archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
+          request = urllib.request.Request(archive_url)
+          if token:
+              request.add_header('Authorization', f'token {token}')
+          with urllib.request.urlopen(request, timeout=120) as response:
+              with open('/tmp/repo.tar.gz', 'wb') as archive:
+                  archive.write(response.read())
+          with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
+              members = archive.getmembers()
+              top_level = members[0].name.split('/')[0] + '/'
+              for member in members:
+                  member.name = member.name.removeprefix(top_level)
+                  if member.name:
+                      archive.extract(member, '.')
+          PY
+
+      # 构建 API 镜像
+      - name: Build API Image
+        run: |
+          VERSION="${{ env.VERSION }}"
+          API_IMAGE="xiaoxia-saas-api:$VERSION"
+          docker build --pull=false \
+            -f infra/docker/api.Dockerfile \
+            -t "$API_IMAGE" \
+            -t "xiaoxia-saas-api:latest" \
+            .
+
+      # 构建 Worker 镜像
+      - name: Build Worker Image
+        run: |
+          VERSION="${{ env.VERSION }}"
+          WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
+          docker build --pull=false \
+            -f infra/docker/worker.Dockerfile \
+            -t "$WORKER_IMAGE" \
+            -t "xiaoxia-saas-worker:latest" \
+            .
+
+      # 构建 Web 镜像
+      - name: Build Web Image
+        run: |
+          VERSION="${{ env.VERSION }}"
+          # 先构建前端
+          docker run --rm \
+            --pull=never \
+            -v "$PWD:/workspace" \
+            -w /workspace/apps/web \
+            docker.m.daocloud.io/library/node:20 \
+            sh -lc 'npm ci && npm run build'
+          # 构建 Nginx 镜像
+          docker build --pull=false \
+            -f infra/docker/web-artifact.Dockerfile \
+            -t "xiaoxia-saas-web:$VERSION" \
+            .
+
+      # 保存镜像
+      - name: Save Images
+        run: |
+          VERSION="${{ env.VERSION }}"
+          mkdir -p dist/release-images dist/release-artifacts
+          
+          # 保存 API + Worker 镜像
+          docker save \
+            "xiaoxia-saas-api:$VERSION" \
+            "xiaoxia-saas-api:latest" \
+            "xiaoxia-saas-worker:$VERSION" \
+            "xiaoxia-saas-worker:latest" \
+            -o dist/release-images/xiaoxia-runtime-images-$VERSION.tar
+          
+          # 保存 Web 镜像
+          docker save "xiaoxia-saas-web:$VERSION" \
+            -o dist/release-images/xiaoxia-web-$VERSION.tar
+
+      # 上传镜像到构建服务器存储
+      - name: Upload Images Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-images-${{ env.VERSION }}
+          path: dist/release-images/
+          retention-days: 7
+
+  # =========================================
+  # Job 2: 打包源码
+  # =========================================
+  package-source:
+    name: Package Source
+    runs-on: runtime-builder:host
+    
+    needs: build-images
+    
+    steps:
+      - name: Checkout code
+        run: |
+          python - <<'PY'
+          import os
+          import tarfile
+          import urllib.request
+
+          api_url = os.environ['GITHUB_API_URL']
+          repository = os.environ['GITHUB_REPOSITORY']
+          sha = os.environ['GITHUB_SHA']
+          token = os.environ.get('GITHUB_TOKEN', '')
+          archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
+          request = urllib.request.Request(archive_url)
+          if token:
+              request.add_header('Authorization', f'token {token}')
+          with urllib.request.urlopen(request, timeout=120) as response:
+              with open('/tmp/repo.tar.gz', 'wb') as archive:
+                  archive.write(response.read())
+          with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
+              members = archive.getmembers()
+              top_level = members[0].name.split('/')[0] + '/'
+              for member in members:
+                  member.name = member.name.removeprefix(top_level)
+                  if member.name:
+                      archive.extract(member, '.')
+          PY
+
+      - name: Package Source
+        run: |
+          VERSION="${{ env.VERSION }}"
+          mkdir -p dist/release-artifacts
+          
+          # 排除不需要的文件
+          tar --exclude=.git \
+              --exclude=apps/web/node_modules \
+              --exclude=apps/web/dist \
+              --exclude=dist \
+              --exclude=*.pyc \
+              --exclude=__pycache__ \
+              -czf "dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" .
+
+      - name: Upload Source Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-source-${{ env.VERSION }}
+          path: dist/release-artifacts/
+          retention-days: 7
+
+  # =========================================
+  # Job 3: 部署到生产环境
+  # =========================================
+  deploy-production:
+    name: Deploy to Production
+    runs-on: runtime-builder:host
+    needs: [build-images, package-source]
+    
+    steps:
+      - name: Download Images
+        uses: actions/download-artifact@v4
+        with:
+          name: release-images-${{ env.VERSION }}
+          path: dist/release-images/
+
+      - name: Download Source
+        uses: actions/download-artifact@v4
+        with:
+          name: release-source-${{ env.VERSION }}
+          path: dist/release-artifacts/
+
+      - name: Upload to Production Server
+        env:
+          PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
+          PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
+          PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
+        run: |
+          VERSION="${{ env.VERSION }}"
+          production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+          production_user="${PRODUCTION_SSH_USER:-root}"
+          
+          mkdir -p ~/.ssh
+          if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+            key_path="$HOME/.ssh/id_ed25519"
+            printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
+            chmod 600 "$key_path"
+          else
+            key_path="/root/.ssh/xiaoxia_runtime_builder"
+          fi
+          
+          ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts 2>/dev/null || true
+          
+          # 创建目录
+          ssh -i "$key_path" "$production_user@$production_host" \
+            "mkdir -p /var/lib/xiaoxia-saas-production"
+
+      - name: Transfer and Deploy
+        env:
+          PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
+          PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
+          PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
+        run: |
+          VERSION="${{ env.VERSION }}"
+          production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+          production_user="${PRODUCTION_SSH_USER:-root}"
+          
+          if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+            key_path="$HOME/.ssh/id_ed25519"
+          else
+            key_path="/root/.ssh/xiaoxia_runtime_builder"
+          fi
+          
+          # 上传镜像
+          scp -i "$key_path" \
+            "dist/release-images/xiaoxia-runtime-images-$VERSION.tar" \
+            "$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
+          
+          scp -i "$key_path" \
+            "dist/release-images/xiaoxia-web-$VERSION.tar" \
+            "$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
+          
+          # 上传源码
+          scp -i "$key_path" \
+            "dist/release-artifacts/xiaoxia-release-$VERSION.tar.gz" \
+            "$production_user@$production_host:/var/lib/xiaoxia-saas-production/"
+
+      - name: Execute Deployment
+        env:
+          PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
+          PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
+          PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
+        run: |
+          VERSION="${{ env.VERSION }}"
+          production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+          production_user="${PRODUCTION_SSH_USER:-root}"
+          
+          if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+            key_path="$HOME/.ssh/id_ed25519"
+          else
+            key_path="/root/.ssh/xiaoxia_runtime_builder"
+          fi
+          
+          ssh -i "$key_path" "$production_user@$production_host" <<'REMOTE_DEPLOY'
+          set -eu
+          
+          VERSION="${{ env.VERSION }}"
+          cd /var/lib/xiaoxia-saas-production
+          
+          # 加载镜像
+          docker load -i "runtime-images-$VERSION.tar"
+          docker load -i "web-$VERSION.tar"
+          
+          # 解压源码
+          rm -rf repo
+          mkdir -p repo
+          tar -xzf "release-$VERSION.tar.gz" -C repo
+          
+          # 复制环境文件
+          cp .env repo/.env
+          
+          # 部署
+          cd repo
+          export API_IMAGE="xiaoxia-saas-api:$VERSION"
+          export WORKER_IMAGE="xiaoxia-saas-worker:$VERSION"
+          export WEB_IMAGE="xiaoxia-saas-web:$VERSION"
+          export APP_VERSION="$VERSION"
+          export RELEASE_VERSION="$VERSION"
+          
+          bash infra/docker/deploy-production.sh
+          
+          # 健康检查
+          i=0
+          while [ "$i" -lt 30 ]; do
+            if wget -qO- http://127.0.0.1:8001/health; then
+              echo "Deployment successful!"
+              exit 0
+            fi
+            i=$((i + 1))
+            sleep 2
+          done
+          
+          echo "Health check failed!"
+          exit 1
+          REMOTE_DEPLOY
+
+  # =========================================
+  # Job 4: 运行 E2E 测试
+  # =========================================
+  e2e-test:
+    name: Run E2E Tests
+    runs-on: runtime-builder:host
+    needs: deploy-production
+    
+    steps:
+      - name: Checkout code
+        run: |
+          python - <<'PY'
+          import os
+          import tarfile
+          import urllib.request
+
+          api_url = os.environ['GITHUB_API_URL']
+          repository = os.environ['GITHUB_REPOSITORY']
+          sha = os.environ['GITHUB_SHA']
+          token = os.environ.get('GITHUB_TOKEN', '')
+          archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
+          request = urllib.request.Request(archive_url)
+          if token:
+              request.add_header('Authorization', f'token {token}')
+          with urllib.request.urlopen(request, timeout=120) as response:
+              with open('/tmp/repo.tar.gz', 'wb') as archive:
+                  archive.write(response.read())
+          with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
+              members = archive.getmembers()
+              top_level = members[0].name.split('/')[0] + '/'
+              for member in members:
+                  member.name = member.name.removeprefix(top_level)
+                  if member.name:
+                      archive.extract(member, '.')
+          PY
+
+      - name: Run Playwright E2E
+        run: |
+          docker run --rm \
+            -e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
+            -e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
+            -e E2E_BROWSER_CHANNEL=chromium \
+            -v "$PWD:/workspace" \
+            -w /workspace/apps/web \
+            mcr.microsoft.com/playwright:v1.45.0-jammy \
+            sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/'
+
+  # =========================================
+  # Job 5: 创建 GitHub Release
+  # =========================================
   create-release:
     name: Create Release
     runs-on: ubuntu-latest
+    needs: [deploy-production, e2e-test]
     
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    
-    - name: Generate changelog
-      id: changelog
-      run: |
-        # Extract changelog for this version
-        VERSION=${GITHUB_REF#refs/tags/}
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-    
-    - name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: Release ${{ steps.changelog.outputs.version }}
-        body: |
-          See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for details.
-        draft: false
-        prerelease: false
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-  build-and-push:
-    name: Build and Push Docker Image
-    runs-on: ubuntu-latest
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-    
-    - name: Log in to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-    
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: xiaoxia/saas
-        tags: |
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
-          type=raw,value=latest
-    
-    - name: Build and push
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+      - name: Generate Changelog
+        id: changelog
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/}
+          # 简单获取 CHANGELOG 中该版本的内容
+          CHANGELOG=$(awk "/^## \[$VERSION\]/,/^## \[/" CHANGELOG.md | head -n -1)
+          echo "body<<EOF" >> $GITHUB_OUTPUT
+          echo "## What's Changed" >> $GITHUB_OUTPUT
+          echo "" >> $GITHUB_OUTPUT
+          echo "$CHANGELOG" >> $GITHUB_OUTPUT
+          echo "" >> $GITHUB_OUTPUT
+          echo "**Full Changelog**: https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          body: ${{ steps.changelog.outputs.body }}
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}