feat(mobile,deploy): 接入安卓极光与华为通道并准备公网部署配置

客户端默认指向 jxd.jinniu.ink 的 HTTPS/WSS；登录后把 OpenIM userID 设为极光 alias。
华为 agconnect-services.json 不伪造、不入库。Master Secret 只从服务器文件注入。

Co-authored-by: multica-agent <github@multica.ai>

scripts/deploy-public.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# 香港测试机公网部署入口（jxd.jinniu.ink）。由总工执行；施工员本卡不跑本脚本，也不 SSH 改现网。
+# 用法: ./scripts/deploy-public.sh
+# 回滚: ./scripts/rollback-public.sh
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+if [ ! -f .env ]; then
+  echo "没有 .env。先从 .env.example 复制，再按 deploy/public/.env.public.example 补公网项。" >&2
+  exit 1
+fi
+
+# 注入 Master Secret（失败则停，避免空密钥启动）
+# shellcheck disable=SC1091
+source ./scripts/load-jpush-secret.sh
+if [ -z "${JPUSH_MASTER_SECRET:-}" ]; then
+  echo "Master Secret 未注入，拒绝启动" >&2
+  exit 1
+fi
+
+mkdir -p deploy/public/acme components/redis/config components/mnt/data components/mongodb components/etcd components/kafka
+touch components/redis/config/redis.conf
+
+docker compose \
+  -f docker-compose.yaml \
+  -f deploy/public/docker-compose.public.yaml \
+  pull
+
+docker compose \
+  -f docker-compose.yaml \
+  -f deploy/public/docker-compose.public.yaml \
+  up -d
+
+echo "已提交 compose 启动。检查: docker compose -f docker-compose.yaml -f deploy/public/docker-compose.public.yaml ps"
+echo "证书未就绪时先用 nginx.bootstrap.conf 申请证书，见 deploy/public/README.md"