feat(deploy): 添加 Gitea 自动部署 Webhook 及配套工具

新增 `/deploy/webhook` 接口，支持 Gitea HMAC 签名校验、指定分支部署、构建并发锁与超时控制
添加前端项目部署脚本 `scripts/deploy_front.sh`，负责拉取代码、安装依赖并执行构建
新增部署相关配置项并更新 `.env.example` 示例配置
更新项目文档说明自动部署的使用约定
补充 `.gitignore` 规则忽略证书和 PEM 格式文件

app/config.py

@@ -3,8 +3,11 @@ from dataclasses import dataclass
 from pathlib import Path
 
 
+PROJECT_ROOT = Path(__file__).parents[1].resolve()
+
+
 def load_local_env() -> None:
-    env_path = Path(__file__).parents[1] / ".env"
+    env_path = PROJECT_ROOT / ".env"
     if not env_path.exists():
         return
 
@@ -43,6 +46,14 @@ WECHAT_PAY_NOTIFY_URL = os.getenv("WECHAT_PAY_NOTIFY_URL", "")
 WECHAT_PAY_API_BASE_URL = os.getenv("WECHAT_PAY_API_BASE_URL", "https://api.mch.weixin.qq.com")
 WECHAT_PAY_SKIP_NOTIFY_VERIFY = os.getenv("WECHAT_PAY_SKIP_NOTIFY_VERIFY", "0") == "1"
 
+DEPLOY_WEBHOOK_SECRET = os.getenv("DEPLOY_WEBHOOK_SECRET", "")
+DEPLOY_PROJECT_DIR = os.getenv("DEPLOY_PROJECT_DIR", str(PROJECT_ROOT))
+DEPLOY_FRONT_DIR = os.getenv("DEPLOY_FRONT_DIR", "front")
+DEPLOY_BRANCH = os.getenv("DEPLOY_BRANCH", "")
+DEPLOY_SCRIPT_PATH = os.getenv("DEPLOY_SCRIPT_PATH", str(PROJECT_ROOT / "scripts" / "deploy_front.sh"))
+DEPLOY_COMMAND_TIMEOUT = int(os.getenv("DEPLOY_COMMAND_TIMEOUT", "600"))
+DEPLOY_LOCK_PATH = os.getenv("DEPLOY_LOCK_PATH", "/tmp/py-web-deploy.lock")
+
 
 @dataclass(frozen=True)
 class OSSSettings:
@@ -136,3 +147,29 @@ wechat_pay_settings = WeChatPaySettings(
     api_base_url=WECHAT_PAY_API_BASE_URL,
     skip_notify_verify=WECHAT_PAY_SKIP_NOTIFY_VERIFY,
 )
+
+
+@dataclass(frozen=True)
+class DeploySettings:
+    webhook_secret: str
+    project_dir: str
+    front_dir: str
+    branch: str
+    script_path: str
+    command_timeout: int
+    lock_path: str
+
+    @property
+    def is_configured(self) -> bool:
+        return bool(self.webhook_secret and self.script_path)
+
+
+deploy_settings = DeploySettings(
+    webhook_secret=DEPLOY_WEBHOOK_SECRET,
+    project_dir=DEPLOY_PROJECT_DIR,
+    front_dir=DEPLOY_FRONT_DIR,
+    branch=DEPLOY_BRANCH,
+    script_path=DEPLOY_SCRIPT_PATH,
+    command_timeout=DEPLOY_COMMAND_TIMEOUT,
+    lock_path=DEPLOY_LOCK_PATH,
+)