feat(infra): 新增生产 Dockerfile 与部署 compose

- api-gateway/Dockerfile: 多阶段构建，golang:1.22-alpine → alpine:3.20，CGO_ENABLED=0 静态编译，非 root 运行

- teacher-portal/Dockerfile: 多阶段构建，node:20-alpine builder → runner，含 HEALTHCHECK

- docker-compose.prod.yml: 本地生产编排，3 服务，强制 DEV_MODE=false

- docker-compose.deploy.yml: 服务器部署用，镜像来自 Gitea Registry，通过 edu-shared 外部网络连接 MySQL/Redis

- deploy.env.example: 部署环境变量模板

services/api-gateway/Dockerfile

@@ -1,15 +1,38 @@
-# Build stage
+# 多阶段构建：api-gateway 生产镜像
+# 用法：docker build -t edu/api-gateway:latest -f services/api-gateway/Dockerfile .
+
+# ============ Builder ============
 FROM golang:1.22-alpine AS builder
 WORKDIR /app
+
+# git 与 ca-certificates 为 go mod 下载所需
+RUN apk add --no-cache git ca-certificates
+
+# 先拷依赖清单利用缓存
 COPY go.mod go.sum ./
 RUN go mod download
-COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -o api-gateway .
 
-# Runtime stage
-FROM alpine:3.20
-RUN apk --no-cache add ca-certificates
+# 拷源码并构建
+COPY . .
+# 静态编译，CGO_DISABLED 便于 alpine 运行
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /app/bin/api-gateway ./main.go
+
+# ============ Runtime ============
+FROM alpine:3.20 AS runner
 WORKDIR /app
-COPY --from=builder /app/api-gateway .
+
+RUN apk add --no-cache ca-certificates tzdata wget
+
+# 非 root 用户
+RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
+
+COPY --from=builder /app/bin/api-gateway /app/api-gateway
+
+USER app
 EXPOSE 8080
-CMD ["./api-gateway"]
+
+# 健康检查
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD wget --quiet --spider http://localhost:8080/healthz || exit 1
+
+ENTRYPOINT ["/app/api-gateway"]