chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

docker-compose.k8s.yml

@@ -7,7 +7,7 @@ services:
     image: ${DOCKERHUB_IMAGE:-lghost/aiops}:${VERSION:-dev}
     build:
       context: .
-      dockerfile: Dockerfile.embed
+      dockerfile: Dockerfile
       args:
         VERSION: ${VERSION:-dev}
         BUILD_TIME: ${BUILD_TIME:-unknown}
@@ -16,12 +16,33 @@ services:
     restart: unless-stopped
     ports:
       - "8080:8080"
+    environment:
+      MODE: ${MODE:-release}
+      DATABASE_DRIVER: ${DATABASE_DRIVER:-mysql}
+      DATABASE_HOST: ${DATABASE_HOST:?请设置 DATABASE_HOST}
+      DATABASE_PORT: ${DATABASE_PORT:-3306}
+      DATABASE_USER: ${DATABASE_USER:?请设置 DATABASE_USER}
+      DATABASE_PASSWORD: ${DATABASE_PASSWORD:?请设置 DATABASE_PASSWORD}
+      DATABASE_DBNAME: ${DATABASE_DBNAME:-aiops}
+      REDIS_DRIVER: ${REDIS_DRIVER:-redis}
+      REDIS_HOST: ${REDIS_HOST:?请设置 REDIS_HOST}
+      REDIS_PORT: ${REDIS_PORT:-6379}
+      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
+      JWT_SECRET: ${JWT_SECRET:?请设置 JWT_SECRET}
     volumes:
       - ./backend/config.external.yaml:/app/config.yaml
-      - /var/run/docker.sock:/var/run/docker.sock
+      - aiops_uploads:/app/uploads
+    # 禁止挂载 Docker Socket；容器控制应使用受限远端 API 或专用执行器。 // Logan.Li
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/version"]
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 40s
+      start_period: 40s
+
+volumes:
+  aiops_uploads: