perf(deploy): 边缘 nginx 承压调优与连接池/PG 参数（P0-2/P0-3）

- 主配置 nginx.conf 进镜像（worker_connections 16384 + rlimit 65536 + gzip
  + 带上游耗时的访问日志）：官方默认 1024×4=4096 连接硬顶是 1w 并发第一道墙
- admin.conf：upstream keepalive 64（proxy_http 1.1 + Connection ""）、
  /public/ /v2-api/ 限流 50r/s burst 200（429）、代理超时 5s/30s、
  /uploads/ /assets/ 30d 缓存头；admin.v2.conf 的 /v2/h5/ 哈希产物长缓存
- compose：PG 显式参数（statement_timeout=10s/max_connections=200/
  shared_buffers=512MB）、DATABASE_URL connection_limit=50&pool_timeout=3
  （单位秒，勿写毫秒；勿加 statement_cache_size=0）、admin ulimits nofile 65536
- 部署注意：主配置走镜像须 rebuild；PG 参数重启前按全局约束 pg_dump+快照存档

deploy/nginx/admin.conf

@@ -1,3 +1,15 @@
+# 上游长连接池（性能整改 P0-2）：与 v2-api 复用连接，消除每请求 TCP 建连；
+# keepalive 连接需配合 proxy_http_version 1.1 + proxy_set_header Connection ""
+upstream v2_api {
+    server v2-api:3001;
+    keepalive 64;
+}
+
+# 防洪峰兜底限流（app 层 120 req/min/IP 更严，这里只挡瞬时洪峰/扫描；
+# 默认 503 会误判服务故障，显式 429）
+limit_req_zone $binary_remote_addr zone=public_api:10m rate=50r/s;
+limit_req_status 429;
+
 server {
     listen 80;
     server_name official.inkreach.cc;
@@ -27,6 +39,7 @@ server {
 
     root /usr/share/nginx/html;
 
+    # ACME challenge for cert renewals
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
     }
@@ -60,22 +73,32 @@ server {
     }
 
     location /v2-api/ {
-        proxy_pass http://v2-api:3001/;
+        proxy_pass http://v2_api/;
         proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
+        limit_req zone=public_api burst=200 nodelay;
     }
 
     # H5 历史构建的 API 基址是同源相对路径 /public/*（BASE_URL="/"），直通 v2 api（路径原样透传）
     location /public/ {
-        proxy_pass http://v2-api:3001;
+        proxy_pass http://v2_api;
         proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 30s;
+        proxy_send_timeout 30s;
+        limit_req zone=public_api burst=200 nodelay;
     }
 
     location = /h5 {
@@ -86,16 +109,25 @@ server {
         try_files $uri $uri/ /h5/index.html;
     }
 
-    # Uploaded files served by the API
+    # Uploaded files served by the API.
+    # 缓存头注意：若运营有「同名替换图片」操作请改短 max-age 或改用版本化 URL
     location /uploads/ {
-        proxy_pass http://v2-api:3001/uploads/;
+        proxy_pass http://v2_api/uploads/;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public";
     }
 
-    # Static product assets served by the API
+    # Static product assets served by the API（哈希文件名，可长缓存）
     location /assets/ {
-        proxy_pass http://v2-api:3001/assets/;
+        proxy_pass http://v2_api/assets/;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
+        expires 30d;
+        add_header Cache-Control "public";
     }
 
     # Website placeholder until the public site is deployed