feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

.agents/skills/nestjs-best-practices/rules/di-prefer-constructor-injection.md

@@ -1,86 +0,0 @@
----
-title: Prefer Constructor Injection
-impact: CRITICAL
-impactDescription: Required for proper DI and testing
-tags: dependency-injection, constructor, testing
----
-
-## Prefer Constructor Injection
-
-Always use constructor injection over property injection. Constructor injection makes dependencies explicit, enables TypeScript type checking, ensures dependencies are available when the class is instantiated, and improves testability. This is required for proper DI, testing, and TypeScript support.
-
-**Incorrect (property injection with hidden dependencies):**
-
-```typescript
-// Property injection - avoid unless necessary
-@Injectable()
-export class UsersService {
-  @Inject()
-  private userRepo: UserRepository; // Hidden dependency
-
-  @Inject('CONFIG')
-  private config: ConfigType; // Also hidden
-
-  async findAll() {
-    return this.userRepo.find();
-  }
-}
-
-// Problems:
-// 1. Dependencies not visible in constructor
-// 2. Service can be instantiated without dependencies in tests
-// 3. TypeScript can't enforce dependency types at instantiation
-```
-
-**Correct (constructor injection with explicit dependencies):**
-
-```typescript
-// Constructor injection - explicit and testable
-@Injectable()
-export class UsersService {
-  constructor(
-    private readonly userRepo: UserRepository,
-    @Inject('CONFIG') private readonly config: ConfigType,
-  ) {}
-
-  async findAll(): Promise<User[]> {
-    return this.userRepo.find();
-  }
-}
-
-// Testing is straightforward
-describe('UsersService', () => {
-  let service: UsersService;
-  let mockRepo: jest.Mocked<UserRepository>;
-
-  beforeEach(() => {
-    mockRepo = {
-      find: jest.fn(),
-      save: jest.fn(),
-    } as any;
-
-    service = new UsersService(mockRepo, { dbUrl: 'test' });
-  });
-
-  it('should find all users', async () => {
-    mockRepo.find.mockResolvedValue([{ id: '1', name: 'Test' }]);
-    const result = await service.findAll();
-    expect(result).toHaveLength(1);
-  });
-});
-
-// Only use property injection for optional dependencies
-@Injectable()
-export class LoggingService {
-  @Optional()
-  @Inject('ANALYTICS')
-  private analytics?: AnalyticsService;
-
-  log(message: string) {
-    console.log(message);
-    this.analytics?.track('log', message); // Optional enhancement
-  }
-}
-```
-
-Reference: [NestJS Providers](https://docs.nestjs.com/providers)