feat(push-gateway): docker 本地验证通过 + nextstep 上下游依赖文档

- Dockerfile 修复：GOPROXY 国内镜像 + go.mod 路径修正 + 构建目录
- docker-compose.deploy.yml 补全 push-gateway 全部 12 个环境变量
- deploy.env.example 新增 push-gateway 段（INTERNAL_API_TOKEN/WS_ALLOWED_ORIGINS）
- 本地 Docker 验证通过（非 mock）：
  - /healthz + /readyz（Redis + Kafka 健康）
  - WebSocket /ws + dev-token 鉴权
  - /internal/push HTTP API 投递 3 类考试事件
  - Kafka → push-gateway → WebSocket 全链路透传
    ExamExtended / ExamForceSubmitted / ExamQuestionReordered
- 新增 docs/nextstep.md：上游依赖（iam/Redis/Kafka）+
  下游依赖（4 portal + msg）+ 事件投递架构图 + 环境变量清单

infra/docker-compose.deploy.yml

@@ -279,7 +279,18 @@ services:
       PUSH_GATEWAY_PORT: 8081
       JWT_SECRET: ${JWT_SECRET}
       REDIS_URL: ${REDIS_URL}
+      KAFKA_BROKERS: ${KAFKA_BROKERS:-kafka:29092}
+      KAFKA_NOTIFICATION_TOPIC: edu.notification.requested
+      KAFKA_CONSUMER_GROUP: push-gateway
+      INTERNAL_API_TOKEN: ${INTERNAL_API_TOKEN:-edu-internal-token}
+      JWKS_URL: http://iam:3002/v1/iam/.well-known/jwks.json
+      WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-http://localhost:3000,http://localhost:4000,http://localhost:4001,http://localhost:4002,http://localhost:4003}
+      MAX_CONNS_PER_USER: "5"
+      HEARTBEAT_INTERVAL_SECONDS: "30"
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-http://otel-collector:4318}
       DEV_MODE: "false"
+    ports:
+      - "${PUSH_GATEWAY_PORT:-8081}:8081"
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--spider", "http://localhost:8081/healthz"]
       interval: 30s