chore(deploy): 生产 docker compose + scratch Dockerfile + 部署文档

- docker-compose.prod.yml：仅 api 绑 127.0.0.1:8120，DB/redis/minio 不暴露，restart=unless-stopped，凭据走 .env
- api/Dockerfile.prod：runtime 改用 scratch + 拷贝 ca-certs（gcr.io/distroless 不可达环境），Go 模块走 goproxy.cn
- .env.example / docs/deploy.md

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

api/Dockerfile.prod

@@ -0,0 +1,16 @@
+# Build stage
+FROM golang:1.23-alpine AS build
+ENV GOPROXY=https://goproxy.cn,direct
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /out/server ./cmd/server
+
+# Runtime stage: scratch + ca-certs copied from the build image.
+# Used for deployments where gcr.io/distroless is not reachable.
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /out/server /server
+EXPOSE 8080
+ENTRYPOINT ["/server"]