feat(server): 工程骨架后端——上传 → 解析 → 清单最小链路

- core：配置（prod 拒绝默认密钥 / dev 短信 / 假模型）、租户事务 + 行级安全策略、
  problem+json 错误码、信封加密与签名下载、对象存储、事务内入队、Valkey stream 事件流、权限点
- identity：手机号 HMAC 存储、注册、登录（挤下线需确认，API3）、服务端会话
- billing：额度流水只追加，预扣 / 结算 / 退回，一笔预扣只有一个结局
- document：分片上传、按文件头识别格式、Gotenberg 转换、文字层与稳定句子编号
- checklist：标注规则识别、模型抽取、三道校验、标注类条款规则兜底、重跑对齐
- ai：提示词注册表（extract.substantive v1 来自 S4 v2）、假模型、OpenAI 兼容供应商、ai_call 流水
- 迁移：data-model 基线、套餐、Procrastinate、会话状态函数
- 测试 30 个：租户隔离、额度、失败退回、对象加密、契约一致性
- Compose（含 migrate）、镜像、CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+# 合并的前提（架构 §8）：类型检查、单元测试、租户隔离用例都通过；接口契约校验通过。
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  server:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: bd_owner
+          POSTGRES_PASSWORD: dev-owner
+          POSTGRES_DB: bid_doctor
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U bd_owner" --health-interval 2s --health-retries 30
+      valkey:
+        image: valkey/valkey:8-alpine
+        ports: ["6379:6379"]
+    env:
+      BD_TEST_PG: 127.0.0.1:5432
+      BD_TEST_VALKEY: redis://127.0.0.1:6379/1
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          version: "0.12.20"
+      - run: uv sync --frozen
+      - name: 数据库角色（和 deploy/compose/postgres/init-roles.sh 一致）
+        env:
+          PGPASSWORD: dev-owner
+        run: |
+          psql -h 127.0.0.1 -U bd_owner -d bid_doctor -v ON_ERROR_STOP=1 \
+            -c "CREATE ROLE bd_app LOGIN PASSWORD 'dev-app'" \
+            -c "CREATE ROLE bd_auth NOLOGIN BYPASSRLS"
+      - working-directory: server
+        run: |
+          ../.venv/bin/ruff check src tests migrations
+          ../.venv/bin/ruff format --check src tests migrations
+          ../.venv/bin/pyright
+          ../.venv/bin/lint-imports
+          ../.venv/bin/pytest -q
+
+  web:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: 接口类型要和 openapi.yaml 一致
+        run: |
+          pnpm gen:api
+          git diff --exit-code packages/api-client/src/schema.d.ts
+      - run: pnpm typecheck
+      - run: pnpm build
+
+  contract:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: OpenAPI 完整校验（api-design §8）
+        run: npx --yes @redocly/cli@1.34.0 lint docs/architecture/openapi.yaml --skip-rule operation-4xx-response --skip-rule no-server-example.com