feat(deploy): single-image docker-compose and kubernetes install.sh

- multi-stage root Dockerfile (opsx-loki pattern): frontend dist +
  go binary + gh-ost in one alpine image, non-root user, HEALTHCHECK,
  entrypoint warning for missing SECRET_KEY; gin now serves the SPA
  from DIST_DIR (asset/db-logos/favicon passthrough, /api returns JSON
  404, SPA fallback to index.html) - one origin, no CORS surface
- docker-compose.yml rewritten: single service, named data volume,
  no-new-privileges + cap_drop ALL, /health healthcheck, resource
  limits, log rotation; SECRET_KEY required (openssl rand -hex 32),
  JWT_SECRET optional (auto-generated and persisted in prod)
- kubernetes/: install.sh one-command deploy (idempotent secret
  reuse, --nodeport/--ingress flags, rollout wait, backup tips) plus
  namespace/secret/pvc/deployment(single replica + Recreate, probes,
  resource limits, non-root)/service/nodeport/ingress manifests and
  README (sqlite single-writer constraints, snapshot backup)
- docs: README quick-start now has 3 deployment paths; ARCHITECTURE
  ch.14 expanded

single-image runtime verified locally (SPA/assets/api/login coexist
on :9002); full image build left to server (docker hub unreachable
from this machine)

docs/ARCHITECTURE.md

@@ -337,8 +337,9 @@ pages/
 
 ## 14. 运维部署
 
+### 14.1 开发环境
+
 ```bash
-# 开发环境
 bash run.sh start      # 启动 Go 后端 (:9000) + 前端 (:5173)
 bash run.sh restart    # 重启
 bash run.sh stop       # 停止
@@ -346,10 +347,36 @@ bash run.sh status     # 状态检查
 
 # 后端编译
 cd backend && go build -o sql-platform ./cmd/server/
+```
 
-# 健康检查
+### 14.2 Docker Compose(单镜像,生产推荐)
+
+多阶段构建:前端 dist + Go 二进制 + gh-ost 合并为一个 alpine 镜像,Gin 同时托管
+静态资源与 API(前后端同源,无 CORS 面);非 root、no-new-privileges、
+cap_drop ALL、/health 健康检查、资源限额与日志轮转(参照 opsx-loki 基线)。
+
+```bash
+export SECRET_KEY=$(openssl rand -hex 32)   # AES 密钥,部署后不可更换
+docker compose up -d --build                # http://localhost:9000
+```
+
+数据持久化在命名卷 `opsxsql-data`(SQLite + 持久化 JWT 密钥)。
+
+### 14.3 Kubernetes
+
+```bash
+bash kubernetes/install.sh --nodeport       # 一键:命名空间/密钥/PVC/Deployment/Service
+```
+
+约束:SQLite 单写者 → Deployment 固定 **replicas=1 + Recreate**(防滚动更新双写)。
+备份:`sqlite3 /app/data/sqlite3.db '.backup ...'` 或 CSI VolumeSnapshot。
+详见 `kubernetes/README.md`。
+
+### 14.4 健康检查
+
+```bash
 curl http://localhost:9000/health
-# → {"status":"ok","version":"0.3.1","backend":"go"}
+# → {"status":"ok","version":"0.4.0","backend":"go"}
 ```
 
 ## 15. 关键设计决策