add Dockerfile + docker-compose: single-image deploy (nginx + backend)

Multi-stage build: node builds frontend dist, golang builds static
binary (modernc sqlite, CGO off), alpine runtime runs nginx :80 +
backend :8890 in one container. nginx serves SPA with fallback, strips
/api prefix (same as vite dev proxy), proxies protocol endpoints
(/mcp, /m/*, /v1/*, /d/*, /ws/*, *.php) with buffering off for
NDJSON/SSE streams and WS upgrade headers.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker/entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+# 后端跑在容器内 8890，nginx 对外 80（托管前端 + 反代 API/协议端点）
+/app/cyibox &
+API_PID=$!
+
+trap 'kill -TERM $API_PID 2>/dev/null' TERM INT
+
+nginx -g 'daemon off;' &
+NGINX_PID=$!
+
+wait $NGINX_PID
+kill -TERM $API_PID 2>/dev/null || true
+wait $API_PID 2>/dev/null || true

docker/nginx.conf

@@ -0,0 +1,81 @@
+server {
+    listen 80;
+    server_name _;
+    root /app/web/dist;
+    index index.html;
+
+    client_max_body_size 512m;
+
+    # 前端 RPC 约定走 /api 前缀，反代时剥掉（与 vite dev proxy 行为一致）
+    # /cell 同时承载 fun.Stream 的 NDJSON 长连接，必须关缓冲
+    location /api/ {
+        proxy_pass http://127.0.0.1:8890/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    # 对外协议端点（不带 /api 前缀，给第三方直接调）：
+    #   /mcp        Streamable HTTP MCP（SSE 推送，关缓冲）
+    #   /m/*        记忆阅读签名链接
+    #   /v1/*       授权校验 / 代理提取
+    #   /d/*        网盘分享下载
+    #   /files/*    SFTP 上传下载
+    #   /ws/*       SSH 终端 WebSocket
+    #   /disk/*     网盘上传下载
+    #   /dbm/*      数据库导入导出
+    #   *.php       Epay 兼容支付端点
+    location ~ ^/(cell|mcp|healthz|m)$ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    location ~ ^/(m|d|v1|files|disk|dbm)/ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_buffering off;
+    }
+
+    location ~ ^/ws/ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_buffering off;
+        proxy_read_timeout 3600s;
+    }
+
+    location ~ ^/(submit|mapi|api)\.php$ {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    # SPA 前端路由兜底
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location ~* \.(js|css|woff2?|ttf|png|jpe?g|svg|ico|webp)$ {
+        try_files $uri =404;
+        expires 7d;
+    }
+}