feat: support gateway-only deployment without client releases

deploy/install.sh

@@ -1,6 +1,14 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
+gateway_only=false
+if [[ "$#" -eq 1 && "$1" == "--gateway-only" ]]; then
+  gateway_only=true
+elif [[ "$#" -ne 0 ]]; then
+  echo "用法：./deploy/install.sh [--gateway-only]" >&2
+  exit 1
+fi
+
 project_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 domain="approval.justconn.top"
 public_base_url="https://${domain}"
@@ -18,7 +26,11 @@ npm_cache="${project_root}/.npm-cache"
 release_private_key="${project_root}/.secrets/release-signing-private.pem"
 release_public_key="${project_root}/distribution/release-signing-public.pem"
 
-for command_name in node npm curl systemctl sudo nginx certbot stat sha256sum tar find sort tail cut date git tea; do
+required_commands=(node npm curl systemctl cut git)
+if [[ "${gateway_only}" == false ]]; then
+  required_commands+=(sudo nginx certbot stat sha256sum tar find sort tail date tea)
+fi
+for command_name in "${required_commands[@]}"; do
   command -v "${command_name}" >/dev/null 2>&1 || {
     echo "缺少部署命令：${command_name}" >&2
     exit 1
@@ -36,9 +48,36 @@ fi
 release_commit="$(git rev-parse HEAD)"
 remote_main="$(git ls-remote origin refs/heads/main | cut -f1)"
 if [[ -z "${remote_main}" || "${remote_main}" != "${release_commit}" ]]; then
-  echo "当前 main 提交尚未同步到 Gitea origin/main，拒绝创建发布标签。" >&2
+  echo "当前 main 提交尚未同步到 Gitea origin/main，拒绝部署。" >&2
   exit 1
 fi
+
+if [[ ! -f "${project_root}/.runtime/dingtalk-mcp.env" ]]; then
+  echo "缺少 .runtime/dingtalk-mcp.env；首次部署前需先配置网关企业凭证。" >&2
+  exit 1
+fi
+
+if [[ "${gateway_only}" == true ]]; then
+  echo "[1/3] 测试并构建网关"
+  npm --cache "${npm_cache}" test
+  node --env-file=.runtime/dingtalk-mcp.env --input-type=module -e '
+    import { loadConfig } from "./dist/src/config.js";
+    const config = loadConfig();
+    if (!config.remoteAuth || !config.xftOpenApi) throw new Error("网关必须同时启用 OAuth、钉钉 OA 与薪福通");
+    console.log(`网关配置检查通过；每账号会话上限 ${config.mcpSessionMaxPerUser}`);
+  '
+  echo "[2/3] 更新并重启网关服务"
+  node dist/src/admin.js service start --project-root "${project_root}"
+  echo "[3/3] 验证网关服务与 OAuth 元数据"
+  systemctl --user is-active --quiet dingtalk-approval-mcp.service
+  curl --fail --silent --show-error --connect-timeout 5 --max-time 15 \
+    --retry 10 --retry-delay 1 --retry-all-errors "${public_base_url}/healthz" >/dev/null
+  curl --fail --silent --show-error --connect-timeout 5 --max-time 15 \
+    "${public_base_url}/.well-known/oauth-protected-resource/mcp" >/dev/null
+  echo "网关部署完成：${release_commit}；客户端发行物未变更。"
+  exit 0
+fi
+
 release_tag_commit="$(git ls-remote origin "refs/tags/${release_tag}" "refs/tags/${release_tag}^{}" | tail -n1 | cut -f1)"
 release_created_at_commit="${release_tag_commit:-${release_commit}}"
 if ! git cat-file -e "${release_created_at_commit}^{commit}" 2>/dev/null; then
@@ -47,11 +86,6 @@ if ! git cat-file -e "${release_created_at_commit}^{commit}" 2>/dev/null; then
 fi
 release_created_at="$(git show -s --format=%cI "${release_created_at_commit}")"
 
-if [[ ! -f "${project_root}/.runtime/dingtalk-mcp.env" ]]; then
-  echo "缺少 .runtime/dingtalk-mcp.env；首次部署前需先配置网关企业凭证。" >&2
-  exit 1
-fi
-
 if [[ ! -f "${release_private_key}" || ! -f "${release_public_key}" ]]; then
   echo "缺少 Ed25519 发布密钥；首次部署请先执行 npm run release:keygen 并安全备份私钥。" >&2
   exit 1