feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

deploy/api.Dockerfile

@@ -0,0 +1,30 @@
+# InkReach API - NestJS + Prisma
+FROM rkli954yqvk81y0vwt.xuanyuan.run/library/node:20-bookworm-slim AS build
+WORKDIR /app
+RUN corepack enable
+ENV NPM_CONFIG_REGISTRY=https://registry.npmmirror.com COREPACK_NPM_REGISTRY=https://registry.npmmirror.com
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml turbo.json ./
+COPY apps/api/package.json apps/api/
+RUN pnpm install --filter @inkreach/api --frozen-lockfile
+
+COPY apps/api apps/api
+# `pnpm deploy` produces a self-contained dir with real files (not pnpm
+# symlinks), which survives the Docker COPY into the runtime stage.
+RUN pnpm --filter @inkreach/api prisma:generate \
+  && pnpm --filter @inkreach/api build \
+  && pnpm --filter @inkreach/api deploy --legacy /app/deployed
+
+FROM rkli954yqvk81y0vwt.xuanyuan.run/library/node:20-bookworm-slim
+WORKDIR /app
+ENV NODE_ENV=production
+# Prisma engines need openssl to detect the libssl version.
+RUN sed -i 's|deb.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources \
+  && apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /app/deployed .
+RUN mkdir -p uploads public
+
+EXPOSE 3001
+CMD ["sh", "-c", "npx prisma migrate deploy && node dist/src/main.js"]