feat(infra): p6 hardening - observability and deploy compose

- 5 NestJS services add /metrics endpoint via app.getHttpAdapter()
- prometheus.yml scales to 8 services with rule_files and alertmanager
- monitoring compose replaces blackbox with Loki+Promtail
- Grafana datasource adds Loki
- docker-compose.deploy.yml scales to 11 services
- deploy.env.example completes Neo4j/ES/ClickHouse/LLM vars
- teacher-bff adds health.controller
- CI removes continue-on-error on lint step
- teacher-portal lint script changed to eslint src

services/teacher-bff/src/app.module.ts

@@ -1,7 +1,9 @@
-import { Module } from '@nestjs/common';
-import { TeacherModule } from './teacher/teacher.module.js';
+import { Module } from "@nestjs/common";
+import { TeacherModule } from "./teacher/teacher.module.js";
+import { HealthController } from "./health.controller.js";
 
 @Module({
   imports: [TeacherModule],
+  controllers: [HealthController],
 })
 export class AppModule {}

services/teacher-bff/src/health.controller.ts

@@ -0,0 +1,30 @@
+import { Controller, Get } from "@nestjs/common";
+
+/**
+ * 健康检查端点。
+ *
+ * - GET /healthz：liveness，仅返回进程存活
+ * - GET /readyz：readiness，无外部依赖可直接返回 ok
+ *
+ * 不需要鉴权，必须在路由白名单中放行。
+ */
+@Controller()
+export class HealthController {
+  @Get("healthz")
+  liveness(): { status: string; service: string; timestamp: string } {
+    return {
+      status: "ok",
+      service: "teacher-bff",
+      timestamp: new Date().toISOString(),
+    };
+  }
+
+  @Get("readyz")
+  readiness(): { status: string; service: string; timestamp: string } {
+    return {
+      status: "ok",
+      service: "teacher-bff",
+      timestamp: new Date().toISOString(),
+    };
+  }
+}