生产 Nginx 收敛到仓库模板并同步生产机 host-only 覆盖

- 主模板 http 段新增 genarrative_gallery_rps 限流 zone，供公开作品架与自定义世界画廊读取接口使用
- 新增 deploy/nginx/snippets/genarrative-host-extras.conf：内部工具页、公开画廊读取 location、主站官网首页入口
- 主模板改为 include host-only snippet，线上 vhost 以仓库模板为唯一来源
- Server-Provision 安装、备份并回滚 genarrative-host-extras.conf，补充 require_path 与临时文件清理
- 生产运维护栏新增 host-only snippet 安装断言
- 运维文档补充主站 SPA 白名单与 host-only 覆盖小节及生效配置核对命令
- 踩坑记录新增线上手工维护漂移条目：/profile 刷新 404 与 client_max_body_size 停在 64m
- 决策记录新增生产 vhost 单一来源、host-only 独立成 snippet、退役路由不做显式 404 的长期口径

scripts/check-production-ops-guardrails.mjs

@@ -2079,6 +2079,12 @@ const checks = [
     reason:
       'Server-Provision 必须安装 Pingora 真实路径 canary snippet，供人工启用直连前中间验证。',
   },
+  {
+    file: 'scripts/jenkins-server-provision.sh',
+    includes: 'genarrative-host-extras.conf',
+    reason:
+      'Server-Provision 必须安装生产机 host-only snippet，避免 provision 后内部工具页与官网首页入口丢失。',
+  },
   {
     file: 'scripts/jenkins-server-provision.sh',
     includes: 'genarrative-pingora-gateway',

scripts/jenkins-server-provision.sh

@@ -1094,13 +1094,16 @@ install_nginx_config_with_rollback() {
   local snippet_target="/etc/nginx/snippets/genarrative-maintenance.conf"
   local pingora_canary_snippet_target="/etc/nginx/snippets/genarrative-pingora-canary.conf"
   local pingora_realpath_canary_snippet_target="/etc/nginx/snippets/genarrative-pingora-realpath-canary.conf"
+  local host_extras_snippet_target="/etc/nginx/snippets/genarrative-host-extras.conf"
   local config_source
   local rendered_config rendered_snippet rendered_pingora_canary_snippet rendered_pingora_realpath_canary_snippet
-  local config_backup snippet_backup pingora_canary_snippet_backup pingora_realpath_canary_snippet_backup disabled_sites
+  local rendered_host_extras_snippet
+  local config_backup snippet_backup pingora_canary_snippet_backup pingora_realpath_canary_snippet_backup host_extras_snippet_backup disabled_sites
   local had_config="false"
   local had_snippet="false"
   local had_pingora_canary_snippet="false"
   local had_pingora_realpath_canary_snippet="false"
+  local had_host_extras_snippet="false"
 
   run_cmd mkdir -p /etc/nginx/snippets /etc/nginx/conf.d
   if [[ "${NGINX_CONFIG_MODE}" == "production-https" ]]; then
@@ -1116,6 +1119,7 @@ install_nginx_config_with_rollback() {
   echo "+ install -m 0644 deploy/nginx/snippets/genarrative-maintenance.conf ${snippet_target}"
   echo "+ install -m 0644 deploy/nginx/snippets/genarrative-pingora-canary.conf ${pingora_canary_snippet_target}"
   echo "+ install -m 0644 deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf ${pingora_realpath_canary_snippet_target}"
+  echo "+ install -m 0644 deploy/nginx/snippets/genarrative-host-extras.conf ${host_extras_snippet_target}"
 
   if [[ "${DRY_RUN}" == "true" ]]; then
     echo "+ disable /etc/nginx/sites-enabled/default* if present"
@@ -1128,10 +1132,12 @@ install_nginx_config_with_rollback() {
   rendered_snippet="$(mktemp)"
   rendered_pingora_canary_snippet="$(mktemp)"
   rendered_pingora_realpath_canary_snippet="$(mktemp)"
+  rendered_host_extras_snippet="$(mktemp)"
   config_backup="$(mktemp)"
   snippet_backup="$(mktemp)"
   pingora_canary_snippet_backup="$(mktemp)"
   pingora_realpath_canary_snippet_backup="$(mktemp)"
+  host_extras_snippet_backup="$(mktemp)"
   disabled_sites="$(mktemp)"
   if [[ "${NGINX_CONFIG_MODE}" == "production-https" ]]; then
     validate_nginx_tls
@@ -1142,6 +1148,7 @@ install_nginx_config_with_rollback() {
   cp deploy/nginx/snippets/genarrative-maintenance.conf "${rendered_snippet}"
   cp deploy/nginx/snippets/genarrative-pingora-canary.conf "${rendered_pingora_canary_snippet}"
   cp deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf "${rendered_pingora_realpath_canary_snippet}"
+  cp deploy/nginx/snippets/genarrative-host-extras.conf "${rendered_host_extras_snippet}"
 
   if [[ -f "${config_target}" ]]; then
     cp -p "${config_target}" "${config_backup}"
@@ -1159,11 +1166,16 @@ install_nginx_config_with_rollback() {
     cp -p "${pingora_realpath_canary_snippet_target}" "${pingora_realpath_canary_snippet_backup}"
     had_pingora_realpath_canary_snippet="true"
   fi
+  if [[ -f "${host_extras_snippet_target}" ]]; then
+    cp -p "${host_extras_snippet_target}" "${host_extras_snippet_backup}"
+    had_host_extras_snippet="true"
+  fi
 
   install -m 0644 "${rendered_config}" "${config_target}"
   install -m 0644 "${rendered_snippet}" "${snippet_target}"
   install -m 0644 "${rendered_pingora_canary_snippet}" "${pingora_canary_snippet_target}"
   install -m 0644 "${rendered_pingora_realpath_canary_snippet}" "${pingora_realpath_canary_snippet_target}"
+  install -m 0644 "${rendered_host_extras_snippet}" "${host_extras_snippet_target}"
   disable_nginx_default_sites_enabled "${disabled_sites}"
 
   if ! nginx -t; then
@@ -1188,14 +1200,19 @@ install_nginx_config_with_rollback() {
     else
       rm -f "${pingora_realpath_canary_snippet_target}"
     fi
+    if [[ "${had_host_extras_snippet}" == "true" ]]; then
+      cp -p "${host_extras_snippet_backup}" "${host_extras_snippet_target}"
+    else
+      rm -f "${host_extras_snippet_target}"
+    fi
     restore_nginx_default_sites_enabled "${disabled_sites}"
-    rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${disabled_sites}"
+    rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${rendered_host_extras_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${host_extras_snippet_backup}" "${disabled_sites}"
     exit 1
   fi
   echo "+ nginx -s reload"
   nginx -s reload
 
-  rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${disabled_sites}"
+  rm -f "${rendered_config}" "${rendered_snippet}" "${rendered_pingora_canary_snippet}" "${rendered_pingora_realpath_canary_snippet}" "${rendered_host_extras_snippet}" "${config_backup}" "${snippet_backup}" "${pingora_canary_snippet_backup}" "${pingora_realpath_canary_snippet_backup}" "${host_extras_snippet_backup}" "${disabled_sites}"
 }
 
 cleanup_placeholder_nginx_config() {
@@ -1417,6 +1434,7 @@ require_path deploy/nginx/genarrative-dev-http.conf
 require_path deploy/nginx/snippets/genarrative-maintenance.conf
 require_path deploy/nginx/snippets/genarrative-pingora-canary.conf
 require_path deploy/nginx/snippets/genarrative-pingora-realpath-canary.conf
+require_path deploy/nginx/snippets/genarrative-host-extras.conf
 require_path deploy/logrotate/genarrative-pingora-gateway
 require_path deploy/env/api-server.env.example
 require_path deploy/env/external-generation-worker.env.example