feat(push-gateway): docker 本地验证通过 + nextstep 上下游依赖文档

- Dockerfile 修复：GOPROXY 国内镜像 + go.mod 路径修正 + 构建目录
- docker-compose.deploy.yml 补全 push-gateway 全部 12 个环境变量
- deploy.env.example 新增 push-gateway 段（INTERNAL_API_TOKEN/WS_ALLOWED_ORIGINS）
- 本地 Docker 验证通过（非 mock）：
  - /healthz + /readyz（Redis + Kafka 健康）
  - WebSocket /ws + dev-token 鉴权
  - /internal/push HTTP API 投递 3 类考试事件
  - Kafka → push-gateway → WebSocket 全链路透传
    ExamExtended / ExamForceSubmitted / ExamQuestionReordered
- 新增 docs/nextstep.md：上游依赖（iam/Redis/Kafka）+
  下游依赖（4 portal + msg）+ 事件投递架构图 + 环境变量清单

infra/deploy.env.example

@@ -31,6 +31,14 @@ ADMIN_PORTAL_PORT=4003
 # ============ Kafka（P3+ 启用，留空则 Outbox publisher 持续重试）============
 KAFKA_BROKERS=
 
+# ============ push-gateway（WebSocket 推送服务）============
+# /internal/push 鉴权 token（msg 服务调用时需携带 X-Internal-Token 头）
+INTERNAL_API_TOKEN=CHANGE_ME_TO_STRONG_INTERNAL_TOKEN
+# WebSocket 允许的 Origin 白名单（逗号分隔）
+WS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:4000,http://localhost:4001,http://localhost:4002,http://localhost:4003
+# push-gateway 对外端口
+PUSH_GATEWAY_PORT=8081
+
 # ============ 可观测性（P6 启用）============
 # OTLP collector 端点，留空则服务跳过 trace 上报
 OTEL_EXPORTER_OTLP_ENDPOINT=http://otel-collector:4318

infra/docker-compose.deploy.yml

@@ -279,7 +279,18 @@ services:
       PUSH_GATEWAY_PORT: 8081
       JWT_SECRET: ${JWT_SECRET}
       REDIS_URL: ${REDIS_URL}
+      KAFKA_BROKERS: ${KAFKA_BROKERS:-kafka:29092}
+      KAFKA_NOTIFICATION_TOPIC: edu.notification.requested
+      KAFKA_CONSUMER_GROUP: push-gateway
+      INTERNAL_API_TOKEN: ${INTERNAL_API_TOKEN:-edu-internal-token}
+      JWKS_URL: http://iam:3002/v1/iam/.well-known/jwks.json
+      WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-http://localhost:3000,http://localhost:4000,http://localhost:4001,http://localhost:4002,http://localhost:4003}
+      MAX_CONNS_PER_USER: "5"
+      HEARTBEAT_INTERVAL_SECONDS: "30"
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://otel-collector:4318}
       DEV_MODE: "false"
+    ports:
+      - "${PUSH_GATEWAY_PORT:-8081}:8081"
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--spider", "http://localhost:8081/healthz"]
       interval: 30s