fix(ci): Harbor HTTP registry + Telegram secrets

CD 修復:
- 修復 buildx HTTP vs HTTPS 問題 (insecure registry 設定)
- 移除 UAT 環境 (違反 Memory 鐵律)
- 新增 Production 部署 Telegram 通知
- 修復 deploy-prod.yml 硬編碼 Token (改用 secrets)

docs:
- 新增 guidelines/ 結構化指引目錄
- ARCHITECTURE.md, FRONTEND.md, OPERATIONS.md

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/cd.yaml

@@ -24,6 +24,14 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          # 修復: Harbor 是 HTTP，需要設定 insecure registry
+          driver-opts: |
+            network=host
+          buildkitd-config-inline: |
+            [registry."192.168.0.110:5000"]
+              http = true
+              insecure = true
 
       - name: Login to WOOO Harbor
         uses: docker/login-action@v3
@@ -53,19 +61,20 @@ jobs:
         run: |
           echo "::notice::Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-${{ matrix.app }}:${{ steps.tag.outputs.tag }}"
 
-  # ==================== Deploy to UAT ====================
-  deploy-uat:
-    name: Deploy to UAT
+  # ==================== Deploy to Production ====================
+  # Memory 鐵律: 禁止 UAT，只有 Dev + Prod
+  deploy-prod:
+    name: Deploy to Production
     runs-on: self-hosted
     needs: build-images
-    environment: uat
+    environment: production
     steps:
       - uses: actions/checkout@v4
 
       - name: Setup Kubeconfig
         run: |
           mkdir -p ~/.kube
-          echo "${{ secrets.KUBE_CONFIG_UAT }}" | base64 -d > ~/.kube/config
+          echo "${{ secrets.KUBE_CONFIG_PROD }}" | base64 -d > ~/.kube/config
           chmod 600 ~/.kube/config
 
       - name: Generate image tag
@@ -77,7 +86,7 @@ jobs:
 
       - name: Deploy with Kustomize
         run: |
-          cd k8s/overlays/uat
+          cd k8s/overlays/prod
           kustomize edit set image \
             awoooi-web=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-web:${{ steps.tag.outputs.tag }} \
             awoooi-api=${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}-api:${{ steps.tag.outputs.tag }}
@@ -85,10 +94,26 @@ jobs:
 
       - name: Wait for rollout
         run: |
-          kubectl rollout status deployment/awoooi-web -n awoooi-uat --timeout=300s
-          kubectl rollout status deployment/awoooi-api -n awoooi-uat --timeout=300s
+          kubectl rollout status deployment/awoooi-web -n awoooi --timeout=300s
+          kubectl rollout status deployment/awoooi-api -n awoooi --timeout=300s
 
       - name: Health check
         run: |
           sleep 10
-          curl -f https://api-uat.awoooi.wooo.work/v1/health || exit 1
+          curl -f https://api.awoooi.wooo.work/api/v1/health || exit 1
+
+      - name: Notify Telegram on Success
+        if: success()
+        run: |
+          curl -s -X POST "https://api.telegram.org/bot${{ secrets.TELEGRAM_BOT_TOKEN }}/sendMessage" \
+            -d chat_id="${{ secrets.TELEGRAM_CHAT_ID }}" \
+            -d text="✅ *AWOOOI 部署成功*%0A%0ACommit: \`${{ github.sha }}\`%0ABranch: \`${{ github.ref_name }}\`%0AWorkflow: [查看](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" \
+            -d parse_mode="Markdown"
+
+      - name: Notify Telegram on Failure
+        if: failure()
+        run: |
+          curl -s -X POST "https://api.telegram.org/bot${{ secrets.TELEGRAM_BOT_TOKEN }}/sendMessage" \
+            -d chat_id="${{ secrets.TELEGRAM_CHAT_ID }}" \
+            -d text="❌ *AWOOOI 部署失敗*%0A%0ACommit: \`${{ github.sha }}\`%0ABranch: \`${{ github.ref_name }}\`%0AWorkflow: [查看](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" \
+            -d parse_mode="Markdown"