docker: 前端 nginx HTTP :2000(外部反代接管域名/TLS,不再内置证书);README + logo

- docker-compose.yml:去 acme,web 端口 2000(WEB_PORT),CORS_ORIGINS/COOKIE_SECURE 直配,清理证书 volumes
- frontend nginx 模板/Dockerfile:纯 HTTP :2000,删自签证书 + cert-watch 入口脚本
- 删除 install.sh、.env.docker.example(compose 直接 up,不再需要一键脚本/模板)
- README(中英):部署改为 Docker(2000端口反代)+ 源码两法;去 acme/自动 HTTPS 表述;结构/徽章同步;顶部加 Vivid logo(favicon.svg);视频 720p/1080p 分辨率对照表(DocsView)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,10 @@
 # image2api — one-command stack: PostgreSQL + Redis + RustFS (S3) + backend
-# (pre-built binary, closed-source — backend/bin/api ships with the repo) +
-# frontend/nginx (open-source, built here).
-#   1) cp .env.docker.example .env   # 填 DOMAIN / ACME_EMAIL / 密码 / 密钥
-#   2) docker compose up -d --build  (或 sh install.sh)
-# Then open https://<DOMAIN>/  (nginx serves the SPA, proxies the API, TLS via acme.sh).
+# (pre-built binary) + frontend/nginx (built here, HTTP only on port 2000).
+# TLS + domain are NOT handled here — put your own reverse proxy in front of the
+# web container (host port ${WEB_PORT:-2000}) and terminate TLS there.
+#   1) cp .env.docker.example .env   # 填 密码 / 密钥 / CORS_ORIGINS
+#   2) docker compose up -d --build
+# Then point your reverse proxy at http://<host>:${WEB_PORT:-2000}.
 services:
   postgres:
     image: postgres:16-alpine
@@ -77,8 +78,10 @@ services:
       RUSTFS_BUCKET: ${S3_BUCKET:-vivid-ai}
       RUSTFS_ACCESS_KEY: ${S3_ACCESS_KEY:-vividai}
       RUSTFS_SECRET_KEY: ${S3_SECRET_KEY:-vividai-secret-change-me}
-      CORS_ORIGINS: https://${DOMAIN:-localhost}
-      COOKIE_SECURE: ${COOKIE_SECURE:-true}
+      # Your site origin(s), comma-separated (the URL your reverse proxy serves).
+      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:2000}
+      # Keep true only if your reverse proxy serves HTTPS; false for plain HTTP.
+      COOKIE_SECURE: ${COOKIE_SECURE:-false}
     volumes:
       - generated:/app/data/generated
     depends_on:
@@ -98,68 +101,16 @@ services:
   web:
     build:
       context: ./frontend
-    environment:
-      DOMAIN: ${DOMAIN:-localhost}
-      # Only substitute ${DOMAIN} in the nginx template — leave $host/$uri/etc.
-      NGINX_ENVSUBST_FILTER: DOMAIN
+    # nginx serves the SPA + proxies the API on container port 2000 (HTTP only).
+    # Point your own reverse proxy at host:${WEB_PORT:-2000}.
     ports:
-      - "${HTTP_PORT:-80}:80"
-      - "${HTTPS_PORT:-443}:443"
-    volumes:
-      - certs:/etc/nginx/certs
-      - acme_webroot:/var/www/acme
+      - "${WEB_PORT:-2000}:2000"
     depends_on:
       - backend
     restart: unless-stopped
 
-  # acme.sh — issues + auto-renews the Let's Encrypt cert via http-01 (webroot
-  # shared with nginx) into the shared certs volume. nginx's cert-watch reloads
-  # it. Requires DOMAIN to resolve to this host and ports 80/443 reachable.
-  acme:
-    image: neilpang/acme.sh:latest
-    depends_on:
-      - web
-    environment:
-      DOMAIN: ${DOMAIN:-localhost}
-      ACME_EMAIL: ${ACME_EMAIL:-admin@example.com}
-      # Persist account + cert state here (a volume on /acme.sh would shadow the
-      # installed binary, so use a separate config-home).
-      LE_CONFIG_HOME: /acme-data
-    volumes:
-      - certs:/etc/nginx/certs
-      - acme_webroot:/var/www/acme
-      - acmedata:/acme-data
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        set -e
-        D="$${DOMAIN:-localhost}"
-        # Skip ACME for non-public domains (localhost / bare IP) — the self-signed
-        # bootstrap cert keeps 443 working for local testing.
-        case "$$D" in
-          localhost|127.0.0.1|"") echo "acme: DOMAIN=$$D not public, skipping issuance"; exec tail -f /dev/null ;;
-        esac
-        mkdir -p /etc/nginx/certs/live/$$D /var/www/acme /acme-data
-        acme.sh --set-default-ca --server letsencrypt
-        acme.sh --register-account -m "$${ACME_EMAIL}" || true
-        # Retry the first issue until nginx :80 is reachable for the http-01 check.
-        i=0
-        while [ $$i -lt 10 ]; do
-          if acme.sh --issue -d "$$D" -w /var/www/acme --keylength ec-256; then break; fi
-          i=$$((i+1)); echo "acme: issue attempt $$i failed, retry in 30s"; sleep 30
-        done
-        acme.sh --install-cert -d "$$D" --ecc \
-          --key-file       /etc/nginx/certs/live/$$D/privkey.pem \
-          --fullchain-file /etc/nginx/certs/live/$$D/fullchain.pem || true
-        # daemon: renew checks daily; renewals auto-reinstall to the paths above.
-        while true; do sleep 12h; acme.sh --cron || true; done
-    restart: unless-stopped
-
 volumes:
   pgdata:
   redisdata:
   rustfsdata:
   generated:
-  certs:
-  acme_webroot:
-  acmedata: