feat(push-gateway): docker 本地验证通过 + nextstep 上下游依赖文档

- Dockerfile 修复：GOPROXY 国内镜像 + go.mod 路径修正 + 构建目录
- docker-compose.deploy.yml 补全 push-gateway 全部 12 个环境变量
- deploy.env.example 新增 push-gateway 段（INTERNAL_API_TOKEN/WS_ALLOWED_ORIGINS）
- 本地 Docker 验证通过（非 mock）：
  - /healthz + /readyz（Redis + Kafka 健康）
  - WebSocket /ws + dev-token 鉴权
  - /internal/push HTTP API 投递 3 类考试事件
  - Kafka → push-gateway → WebSocket 全链路透传
    ExamExtended / ExamForceSubmitted / ExamQuestionReordered
- 新增 docs/nextstep.md：上游依赖（iam/Redis/Kafka）+
  下游依赖（4 portal + msg）+ 事件投递架构图 + 环境变量清单

services/push-gateway/Dockerfile

@@ -8,19 +8,19 @@ WORKDIR /app
 # git 与 ca-certificates 为 go mod 下载所需
 RUN apk add --no-cache git ca-certificates
 
-# 利用 go.work 时需拷贝根 go.work 与 shared-go 包
-COPY go.mod go.sum ./
-COPY packages/shared-go ./packages/shared-go
+# 拷贝 shared-go 和 push-gateway 的 go.mod（用于 go mod download 缓存层）
+COPY packages/shared-go/go.mod ./packages/shared-go/
 COPY services/push-gateway/go.mod services/push-gateway/go.sum ./services/push-gateway/
+ENV GOPROXY=https://goproxy.cn,direct
 RUN cd services/push-gateway && go mod download
 
 # 拷源码并构建（静态编译便于 alpine 运行）
 COPY services/push-gateway ./services/push-gateway
 COPY packages/shared-go ./packages/shared-go
-RUN CGO_ENABLED=0 GOOS=linux go build \
+RUN cd services/push-gateway && CGO_ENABLED=0 GOOS=linux go build \
     -ldflags="-s -w -X main.serviceName=push-gateway" \
     -o /app/bin/push-gateway \
-    ./services/push-gateway
+    .
 
 # ============ Runtime ============
 FROM alpine:3.20 AS runner