ci: 添加 Gitea Actions 部署流水线 + K3s 清单

对齐 jimeng-clone 的流水线结构(master→prod / dev→dev),适配 AirShelf 纯静态形态:
- 电商AI平台/Dockerfile · 纯 nginx,无 build 阶段
- 电商AI平台/nginx.conf · 多入口 try_files,不 fallback 到 index.html
- k8s/ · web-deployment + ingress + cert-issuer + redirect middleware
- .gitea/workflows/deploy.yaml · build/push 重试 3 次,deploy 重试 5 次,失败上报日志中心
- prod 域名 airshelf.airlabs.art / dev 域名 airshelf.test.airlabs.art

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

k8s/cert-manager-issuer.yaml

@@ -0,0 +1,15 @@
+# ClusterIssuer for Let's Encrypt automatic certificate generation & renewal
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: airlabsv001@gmail.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-key
+    solvers:
+    - http01:
+        ingress:
+          class: traefik

k8s/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: airshelf-ingress
+  annotations:
+    kubernetes.io/ingress.class: "traefik"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: "default-redirect-https@kubernetescrd"
+spec:
+  tls:
+  - hosts:
+    - airshelf.airlabs.art
+    secretName: airshelf-tls
+  rules:
+  - host: airshelf.airlabs.art
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: airshelf-web
+            port:
+              number: 80

k8s/redirect-https-middleware.yaml

@@ -0,0 +1,8 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true

k8s/web-deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: airshelf-web
+  labels:
+    app: airshelf-web
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: airshelf-web
+  template:
+    metadata:
+      labels:
+        app: airshelf-web
+    spec:
+      imagePullSecrets:
+      - name: cr-pull-secret
+      containers:
+      - name: airshelf-web
+        image: ${CI_REGISTRY_IMAGE}/airshelf-web:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+        livenessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 80
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+        resources:
+          requests:
+            memory: "32Mi"
+            cpu: "20m"
+          limits:
+            memory: "128Mi"
+            cpu: "150m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: airshelf-web
+spec:
+  selector:
+    app: airshelf-web
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80