feat: 公开首页(搜索+商品详情) + 好心人投稿 + 后台审核收纳

- 公开前端 SPA（根路径 /）：首页大搜索框、检索结果、只读商品详情、贡献档案表单
- 公开写入端点 POST /api/public/submissions（无需登录，基础频率限流），投稿进入 submission 待审核队列，不直接写 product
- 迁移 0006：submission 投稿表 + community 来源(trust=0.50)
- 后台审核队列：列表(待审核/已通过/已驳回) → 查看投稿 → 通过(创建/补全商品 + 记 source=community + 字段级溯源 + 审计 + 重算质量分) / 驳回(记原因)
- 公开只读 api 服务内嵌公开 SPA；Dockerfile.prod 增加 node 构建阶段 + 内嵌 dist

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

public-frontend/src/api.ts

@@ -0,0 +1,40 @@
+import type { Category, Product, ProductSummary, SubmissionInput } from "./types";
+
+async function req<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(path, {
+    ...init,
+    headers: { "Content-Type": "application/json", ...(init?.headers || {}) },
+  });
+  if (!res.ok) {
+    let msg = `请求失败 (${res.status})`;
+    try {
+      const body = await res.json();
+      if (body?.error?.message) msg = body.error.message;
+    } catch {
+      /* ignore */
+    }
+    throw new Error(msg);
+  }
+  return res.json() as Promise<T>;
+}
+
+export interface SearchResult {
+  items: ProductSummary[];
+  page: number;
+  size: number;
+  total: number;
+}
+
+export const api = {
+  search: (q: string, page = 1, size = 20) =>
+    req<SearchResult>(
+      `/api/v1/products/search?q=${encodeURIComponent(q)}&page=${page}&size=${size}`,
+    ),
+  product: (id: string) => req<Product>(`/api/v1/products/${id}`),
+  categories: () => req<{ items: Category[] }>(`/api/v1/categories`),
+  submit: (input: SubmissionInput) =>
+    req<{ id: string; status: string }>(`/api/public/submissions`, {
+      method: "POST",
+      body: JSON.stringify(input),
+    }),
+};