docs: 补充部署示例、worktrees 设置并记录 T0.1 偏差

deploy/Dockerfile

@@ -0,0 +1,24 @@
+# 多阶段骨架：完整多架构发布见 Q4。
+# 语法阶段：Node 构建前端 → Go 编译（嵌入前端）→ distroless 运行。
+
+FROM node:24-bookworm AS web
+WORKDIR /src/web
+COPY web/package.json web/pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --frozen-lockfile
+COPY web/ ./
+RUN pnpm build
+
+FROM golang:1.27-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=web /src/web/dist ./web/dist
+ENV CGO_ENABLED=0
+RUN go build -tags embeddist -o /out/nixmsg ./cmd/nixmsg
+
+FROM gcr.io/distroless/static:nonroot
+COPY --from=build /out/nixmsg /nixmsg
+USER nonroot:nonroot
+ENTRYPOINT ["/nixmsg"]
+CMD ["serve"]

deploy/config.example.yaml

@@ -0,0 +1,31 @@
+listen: ":7443"                   # 端接入端口
+admin_listen: ""                  # 后台单独监听，如 "127.0.0.1:7444"；空表示后台也在 listen 上
+tls:
+  cert_file: ""
+  key_file: ""
+  allow_plaintext: false
+trusted_proxies: []               # 反向代理的地址段，如 ["127.0.0.1/32"]
+data_dir: "./data"
+limits:
+  max_body_bytes: 262144          # 只能调小
+  max_meta_bytes: 4096
+  max_frame_bytes: 786432
+  max_ttl_seconds: 2592000
+  max_schedule_seconds: 31536000
+  max_group_members: 1000
+  grace_seconds: 60
+  ack_timeout_seconds: 300
+  delivery_window: 32
+  receipt_window: 64
+  requests_per_second: 50         # 除 ack、receipt_ack 外，突发容量为 2 倍
+  max_pending_per_sender: 10000   # 等待发送或投递中的消息数，群消息算一条；0 表示不限
+  max_pending_per_receiver: 10000 # 排队未收下的投递数；0 表示不限
+session_idle_days: 30             # 会话令牌多少天没用就失效；0 表示不失效
+record_retention_days: 7          # 0 表示完成后不留记录
+idempotency_hours: 24
+receipt_retention_days: 7
+sqlite_synchronous: FULL          # 或 NORMAL
+metrics:
+  token: ""                       # 后台和端共用端口时，访问 /metrics 要带它；空表示共用端口时不提供
+log:
+  level: info