feat(server): 工程骨架后端——上传 → 解析 → 清单最小链路

- core：配置（prod 拒绝默认密钥 / dev 短信 / 假模型）、租户事务 + 行级安全策略、
  problem+json 错误码、信封加密与签名下载、对象存储、事务内入队、Valkey stream 事件流、权限点
- identity：手机号 HMAC 存储、注册、登录（挤下线需确认，API3）、服务端会话
- billing：额度流水只追加，预扣 / 结算 / 退回，一笔预扣只有一个结局
- document：分片上传、按文件头识别格式、Gotenberg 转换、文字层与稳定句子编号
- checklist：标注规则识别、模型抽取、三道校验、标注类条款规则兜底、重跑对齐
- ai：提示词注册表（extract.substantive v1 来自 S4 v2）、假模型、OpenAI 兼容供应商、ai_call 流水
- 迁移：data-model 基线、套餐、Procrastinate、会话状态函数
- 测试 30 个：租户隔离、额度、失败退回、对象加密、契约一致性
- Compose（含 migrate）、镜像、CI

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/compose/compose.yaml

@@ -0,0 +1,84 @@
+# 本地开发与 SaaS 内测期的编排（T4）。
+#   只起依赖：  docker compose -f deploy/compose/compose.yaml up -d postgres valkey gotenberg
+#   全部起来：  docker compose -f deploy/compose/compose.yaml --profile app up -d --build
+# 端口只绑 127.0.0.1；生产环境的密钥从环境变量注入，不写在这里。
+name: bid-doctor
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: bd_owner
+      POSTGRES_PASSWORD: ${BD_PG_OWNER_PASSWORD:-dev-owner}
+      POSTGRES_DB: bid_doctor
+      BD_APP_PASSWORD: ${BD_PG_APP_PASSWORD:-dev-app}
+    ports: ["127.0.0.1:${BD_PG_PORT:-54329}:5432"]
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - ./postgres/init-roles.sh:/docker-entrypoint-initdb.d/10-roles.sh:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U bd_owner -d bid_doctor"]
+      interval: 2s
+      retries: 30
+
+  valkey:
+    image: valkey/valkey:8-alpine
+    command: ["valkey-server", "--save", "", "--appendonly", "no"]   # 只存丢了也没关系的数据（AR4）
+    ports: ["127.0.0.1:${BD_VALKEY_PORT:-63799}:6379"]
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 2s
+      retries: 30
+
+  gotenberg:
+    image: gotenberg/gotenberg:8
+    command:
+      - gotenberg
+      - --api-timeout=240s
+      - --libreoffice-restart-after=50
+    # 转换服务不应访问外网（架构 §3.5）。本地开发要从宿主机访问它，所以放在默认网络；
+    # 生产编排（Helm / 生产 compose）用网络策略禁止它的出口流量。
+    ports: ["127.0.0.1:${BD_GOTENBERG_PORT:-3109}:3000"]
+
+  migrate:
+    profiles: [app]
+    image: bid-doctor-server
+    build: { context: ../.., dockerfile: deploy/docker/server.Dockerfile }
+    command: ["bid-doctor", "migrate"]
+    env_file: [{ path: ../../.env, required: false }]
+    environment:
+      BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
+    depends_on:
+      postgres: { condition: service_healthy }
+
+  api:
+    profiles: [app]
+    image: bid-doctor-server
+    command: ["bid-doctor", "api", "--host", "0.0.0.0", "--port", "8000"]
+    env_file: [{ path: ../../.env, required: false }]
+    environment: &app-env
+      BD_DATABASE_URL: postgresql+psycopg://bd_app:${BD_PG_APP_PASSWORD:-dev-app}@postgres:5432/bid_doctor
+      BD_MIGRATE_DATABASE_URL: postgresql+psycopg://bd_owner:${BD_PG_OWNER_PASSWORD:-dev-owner}@postgres:5432/bid_doctor
+      BD_VALKEY_URL: redis://valkey:6379/0
+      BD_GOTENBERG_URL: http://gotenberg:3000
+      BD_STORAGE_DIR: /data/objects
+    ports: ["127.0.0.1:${BD_API_PORT:-8009}:8000"]
+    volumes: [objects:/data/objects]
+    depends_on:
+      migrate: { condition: service_completed_successfully }
+      valkey: { condition: service_healthy }
+
+  worker:
+    profiles: [app]
+    image: bid-doctor-server
+    command: ["bid-doctor", "worker"]
+    env_file: [{ path: ../../.env, required: false }]
+    environment: *app-env
+    volumes: [objects:/data/objects]
+    depends_on:
+      migrate: { condition: service_completed_successfully }
+      valkey: { condition: service_healthy }
+
+volumes:
+  pgdata: {}
+  objects: {}