ci: 添加 Gitea Actions 部署流水线 + K3s 清单

对齐 jimeng-clone 的流水线结构(master→prod / dev→dev),适配 AirShelf 纯静态形态:
- 电商AI平台/Dockerfile · 纯 nginx,无 build 阶段
- 电商AI平台/nginx.conf · 多入口 try_files,不 fallback 到 index.html
- k8s/ · web-deployment + ingress + cert-issuer + redirect middleware
- .gitea/workflows/deploy.yaml · build/push 重试 3 次,deploy 重试 5 次,失败上报日志中心
- prod 域名 airshelf.airlabs.art / dev 域名 airshelf.test.airlabs.art

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

电商AI平台/.dockerignore

@@ -0,0 +1,7 @@
+Dockerfile
+.dockerignore
+.git
+.gitignore
+.DS_Store
+*.md
+node_modules

电商AI平台/Dockerfile

@@ -0,0 +1,10 @@
+# ---- Runtime Stage (no build — pure static HTML/CSS/JS) ----
+FROM docker.m.daocloud.io/nginx:alpine
+
+RUN sed -i 's#dl-cdn.alpinelinux.org#mirrors.aliyun.com#g' /etc/apk/repositories
+
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY . /usr/share/nginx/html/
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]

电商AI平台/nginx.conf

@@ -0,0 +1,28 @@
+server_tokens off;
+charset utf-8;
+
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
+    # Cache static assets (CSS/JS/images/fonts)
+    location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|mp4|webm)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Multi-page (not SPA): try exact file, then .html fallback (friendly URLs), then 404.
+    # NEVER fallback to index.html — that masks 404s for a multi-entry design shelf.
+    location / {
+        try_files $uri $uri/ $uri.html =404;
+    }
+}