fix(部署): 将模板迁移 SQL 打包到后端镜像

V28 迁移运行时需要读取 db/migration，补齐镜像复制与构建白名单。
同时保留后端镜像使用的周期检查入口。

.dockerignore

@@ -0,0 +1,35 @@
+# 构建上下文白名单，防止本地配置、客户资料和虚拟环境被发送到构建器。
+**
+!backend/
+!backend/Dockerfile
+!backend/pyproject.toml
+!backend/uv.lock
+!backend/.python-version
+!backend/alembic.ini
+!backend/app/
+!backend/app/**
+!backend/alembic/
+!backend/alembic/**
+!db/
+!db/migration/
+!db/migration/**
+!db/queries/
+!db/queries/tplus/
+!db/queries/tplus/**
+!frontend/
+!frontend/Dockerfile
+!frontend/package.json
+!frontend/pnpm-lock.yaml
+!frontend/index.html
+!frontend/tsconfig*.json
+!frontend/vite.config.ts
+!frontend/.env.production
+!frontend/src/
+!frontend/src/**
+!frontend/public/
+!frontend/public/**
+!docker/
+!docker/nginx.prod.conf
+!docker/tplus-maintenance.sh
+**/__pycache__
+**/*.pyc

backend/Dockerfile

@@ -0,0 +1,43 @@
+# 从仓库根目录构建：docker build -f backend/Dockerfile -t ys-payroll-backend:release .
+FROM ghcr.io/astral-sh/uv:0.12.13 AS uv
+FROM python:3.12-slim-bookworm
+
+ENV TZ=Asia/Shanghai \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never \
+    PATH="/app/backend/.venv/bin:$PATH"
+
+# 这里只安装客户端驱动，连接客户现场 SQL Server；镜像内没有 T+ 数据库。
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl gnupg unixodbc tzdata \
+    && curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
+        | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" \
+        > /etc/apt/sources.list.d/mssql-release.list \
+    && apt-get update \
+    && ACCEPT_EULA=Y DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends msodbcsql18 \
+    && apt-get purge -y curl gnupg \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=uv /uv /usr/local/bin/uv
+WORKDIR /app/backend
+COPY backend/pyproject.toml backend/uv.lock backend/.python-version ./
+RUN uv sync --frozen --no-dev --extra tplus --no-cache
+
+COPY backend/alembic.ini ./
+COPY backend/alembic ./alembic
+COPY backend/app ./app
+# 保留仓库相对布局，覆盖读取、总量、关联核验和样本核对 SQL。
+COPY db/queries/tplus /app/db/queries/tplus
+# V28 迁移从仓库路径读取留存 SQL，镜像必须携带该运行时依赖。
+COPY db/migration /app/db/migration
+COPY docker/tplus-maintenance.sh /app/tplus-maintenance.sh
+
+RUN mkdir -p /app/backend/uploads /app/backend/logs \
+    && useradd --uid 10001 --create-home appuser \
+    && chown -R appuser:appuser /app/backend/uploads /app/backend/logs
+USER appuser
+CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

docker/tplus-maintenance.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# 复用已有单次检查命令；即使检查失败也保留日志并等待下一轮。
+set -u
+stopping=0
+child_pid=
+stop() {
+    stopping=1
+    if [ -n "$child_pid" ]; then
+        kill -TERM "$child_pid" 2>/dev/null || :
+    fi
+}
+trap stop TERM INT
+while [ "$stopping" -eq 0 ]; do
+    python -m app.cli tplus-maintain --once &
+    child_pid=$!
+    if ! wait "$child_pid" && [ "$stopping" -eq 0 ]; then
+        echo 'T+ 周期检查未完成，请检查运行配置；下一轮重试。' >&2
+    fi
+    [ "$stopping" -eq 0 ] || break
+    sleep 60 &
+    child_pid=$!
+    wait "$child_pid" || :
+done