HEL-270: 验收物料——非root加固、备份/巡检脚本、运维手册、修复 reminders 布局冒烟测试

Co-authored-by: multica-agent <github@multica.ai>

deploy/compose.yaml

@@ -1,36 +1,35 @@
-# 测试环境部署编排。正式口令不得写入本文件。
-# 使用：复制 .env.example 为 .env 后填写，再执行 ./deploy.sh
+# 测试/正式环境部署编排（正式口令不得写入本文件）。
+# 使用：复制 .env.example 为 .env 填写；TAG 指定镜像标签（默认取当前提交 sha）。
+# 例：TAG=v1.0.0-rc1 docker compose -f compose.yaml up -d --build
 
 services:
-  caiwuzongzhang:
+  app:
+    container_name: caiwuzongzhang-app
+    image: caiwuzongzhang:${TAG:-latest}
     build:
       context: ..
       dockerfile: deploy/Dockerfile
-    image: caiwuzongzhang:test
-    container_name: caiwuzongzhang-test
-    ports:
-      - "4173:4173"
     env_file:
       - .env
-    environment:
-      APP_HOST: "0.0.0.0"
-      APP_PORT: "4173"
-      APP_DB_PATH: /app/data/app.db
-      APP_STORAGE_DIR: /app/data/files
+    ports:
+      - "4173:4173"
     volumes:
       - ../data:/app/data
+    init: true
+    restart: unless-stopped
     read_only: true
     tmpfs:
-      - /tmp
-    cap_drop:
-      - ALL
+      - /tmp:size=64m,mode=1777
     security_opt:
       - no-new-privileges:true
+    cap_drop:
+      - ALL
+    pids_limit: 128
     mem_limit: 512m
-    restart: unless-stopped
+    cpus: 1.0
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:4173/', timeout=4)"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 20s
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:4173/', timeout=2)"]
+      interval: 15s
+      timeout: 3s
+      retries: 5
+      start_period: 10s