仓库自包含化：Docker/CI/文档/规范入库，路由分组拆分

Dockerfile

@@ -0,0 +1,33 @@
+# 两阶段构建 + artifact 导出层(build stage 交叉编译,多平台构建无需 QEMU):
+#   镜像:   docker build -t oci-portal .
+#   二进制: docker buildx build --platform linux/amd64,linux/arm64 --target artifact \
+#             --output type=local,dest=./output .   # 产物在 output/linux_{amd64,arm64}/
+#
+# 完整产物需先把前端 dist 放进 internal/webui/dist(否则嵌入的是占位页):
+#   本地: 前端仓库 npm run build 后拷入,或从前端 Release 下载 dist.zip 解压
+#   CI:  release.yml 从前端仓库 latest Release 下载 dist.zip(见 .gitea/.github workflows)
+
+# stage 1: 后端(嵌入 dist);跑在构建机原生平台上交叉编译,多平台构建无需 QEMU
+FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . ./
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+  go build -trimpath -ldflags "-s -w" -o /oci-portal-server ./cmd/server
+
+# artifact: 仅承载二进制,供 buildx --output type=local 导出(release 流程用)
+FROM scratch AS artifact
+COPY --from=build /oci-portal-server /oci-portal-server
+
+# stage 2: 运行层(distroless/static 自带系统 CA,OCI API 的 HTTPS 依赖它;nonroot 用户)
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /oci-portal-server /oci-portal-server
+# SQLite 数据卷;DB_PATH 指向卷内路径(见 docker-compose.yml)
+VOLUME ["/data"]
+EXPOSE 8080
+# distroless 无 shell,探活用二进制自检 flag
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
+  CMD ["/oci-portal-server", "-healthcheck"]
+ENTRYPOINT ["/oci-portal-server"]