feat(docker): 生产环境 DevOps 基础设施 — TLS + 备份加密 + Prometheus + Redis 持久化

新增:
- nginx/nginx.conf: TLS 1.2/1.3 终端 + HSTS/CSP 安全头 + SSE 长连接 + 50M 上传限制
- prometheus/prometheus.yml: HMS/PostgreSQL/Redis/Nginx 四指标源
- prometheus/alerts.yml: 4 组告警规则（系统/应用/数据库/Redis），含 5xx 错误率 + 内存 + 连接数
- restore.sh: 备份恢复脚本（支持加密备份解密恢复）

改进:
- backup.sh: 新增 BACKUP_PASSPHRASE 加密（AES-256-CBC）+ 完整性校验 + 恢复指引
- docker-compose.production.yml: 添加 Nginx/Prometheus/Grafana/uploads-backup 容器
- docker-compose.yml: Redis 添加 --appendonly yes 持久化
- .env.production.example: 添加 DevOps 相关环境变量模板

docker/docker-compose.production.yml

@@ -2,15 +2,44 @@
 # 使用方式: docker compose -f docker/docker-compose.yml -f docker/docker-compose.production.yml up -d
 
 services:
+  # ── Nginx 反代 + TLS 终端 ──
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: hms-nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx/ssl:/etc/nginx/ssl:ro
+      - nginx_logs:/var/log/nginx
+    depends_on:
+      app:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://localhost:80"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      resources:
+        limits:
+          cpus: "0.5"
+          memory: 128M
+    networks:
+      - hms-internal
+
+  # ── HMS 应用服务器 ──
   app:
     build:
       context: ..
       dockerfile: Dockerfile
     container_name: hms-server
     restart: unless-stopped
-    ports:
-      - "${APP_PORT:-3000}:3000"
-      - "${METRICS_PORT:-9090}:9090"
+    expose:
+      - "3000"
+      - "9090"
     env_file:
       - .env.production
     environment:
@@ -40,8 +69,7 @@ services:
     networks:
       - hms-internal
 
-  # 每日自动备份 — 每天凌晨 02:00 执行 pg_dump，保留 7 天
-  # 手动触发: docker compose -f docker/docker-compose.yml -f docker/docker-compose.production.yml run --rm backup
+  # ── 每日自动备份（含加密）──
   backup:
     image: postgres:16-alpine
     container_name: hms-backup
@@ -59,6 +87,7 @@ services:
       BACKUP_DIR: /backups
       KEEP_DAYS: "${BACKUP_KEEP_DAYS:-7}"
       BACKUP_CRON: "${BACKUP_CRON:-0 2 * * *}"
+      BACKUP_PASSPHRASE: "${BACKUP_PASSPHRASE:-}"
     volumes:
       - ./backup.sh:/usr/local/bin/backup.sh:ro
       - backup_data:/backups
@@ -68,11 +97,76 @@ services:
     networks:
       - hms-internal
 
+  # ── uploads 文件备份（同步到宿主机）──
+  uploads-backup:
+    image: alpine:3.20
+    container_name: hms-uploads-backup
+    restart: unless-stopped
+    entrypoint: >
+      sh -c "
+        echo '$$UPLOADS_BACKUP_CRON rsync -a --delete /source/uploads/ /backup/uploads/' > /etc/crontabs/root &&
+        crond -f -l 2
+      "
+    environment:
+      UPLOADS_BACKUP_CRON: "${UPLOADS_BACKUP_CRON:-0 3 * * *}"
+    volumes:
+      - app-uploads:/source/uploads:ro
+      - uploads_backup_data:/backup/uploads
+    networks:
+      - hms-internal
+
+  # ── Prometheus 监控 ──
+  prometheus:
+    image: prom/prometheus:v3.1.0
+    container_name: hms-prometheus
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yml"
+      - "--storage.tsdb.retention.time=30d"
+      - "--storage.tsdb.retention.size=2GB"
+      - "--web.enable-lifecycle"
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./prometheus/alerts.yml:/etc/prometheus/alerts.yml:ro
+      - prometheus_data:/prometheus
+    expose:
+      - "9090"
+    networks:
+      - hms-internal
+
+  # ── Grafana 可视化 ──
+  grafana:
+    image: grafana/grafana:11.4.0
+    container_name: hms-grafana
+    restart: unless-stopped
+    environment:
+      GF_SECURITY_ADMIN_USER: "${GRAFANA_ADMIN_USER:-admin}"
+      GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD:-}"
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SERVER_ROOT_URL: "${GRAFANA_ROOT_URL:-http://localhost:3001}"
+    volumes:
+      - grafana_data:/var/lib/grafana
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+    expose:
+      - "3000"
+    depends_on:
+      - prometheus
+    networks:
+      - hms-internal
+
 volumes:
   app-uploads:
     driver: local
   backup_data:
     driver: local
+  uploads_backup_data:
+    driver: local
+  nginx_logs:
+    driver: local
+  prometheus_data:
+    driver: local
+  grafana_data:
+    driver: local
 
 networks:
   hms-internal: