chore(release): v0.5.0-beta 发版准备

主要改动:

backend 业务:
- feat(error-codes): 统一错误码表 E1011/E1012 拆码
  - E1011 AUTH_PASSWORD_WRONG: 本地密码错误
  - E1012 AUTH_FIRST_LOGIN_PASSWORD_REQUIRED: 首次登录请先设置密码
  - E1015 AUTH_OLD_PASSWORD_REQUIRED: 改密需要旧密码
  - E1016 AUTH_OLD_PASSWORD_WRONG: 旧密码错误
- fix(agents): P0 降级放行时,如坐席已注册但未设密码,正确 raise 1012
  (修复前会撞 1011 本地密码错误,与场景不符)
- feat(approval): 审批模块 (T审批/A审批)
- feat(config): approval_template_resource / approval_template_device 配置
- feat(main): /ready, /metrics, /version 端点(K8s 友好)

backend 测试:
- test(agents): 新增 test_agents.py — 3 个 Fix-4 降级登录测试
  - 错误密码拒绝
  - 缺密码拒绝
  - 正确密码通过
  pytest tests/test_agents.py → 3/3 通过
- test(conftest): 模块级 mock + slowapi 限流重置 + UTF-8 patch
  解决 Windows pytest GBK 读 .env 失败 + 降级路径无法测试

仓库治理:
- chore(gitignore): 排除 .workbuddy/memory/(workbuddy 本地记忆)
- chore(docs): 重命名两份 IT 文档(前缀加智能区分版本)

部署与文档:
- docs: RELEASE_NOTES_v0.5.0-beta.md / dashboard.html / 需求-发版预览页面
- docs: 部署、架构、PRD、安全、评审报告等同步 v0.5.0-beta
- deploy-server: 打包脚本、nginx、docker-compose 版本号 bump

前端 (frontend-h5 / frontend-agent / frontend-admin / frontend-portal):
- index.html / package.json 版本号与构建号 bump

自动验收(RELEASE_NOTES L100-104):
- [x] pytest tests/test_agents.py -v → 3 passed
- [x] grep Bs7ucT backend frontend-h5 frontend-agent → 无输出
- [x] grep AppException(101[123]) backend → 仅 1 处(登录场景 1012)
- [ ] npm run build (frontend-h5 / frontend-agent) → 合并后跑

后续: 合并 feature/t-1-t4-merge → main,tag v0.5.0-beta

backend/app/main.py

@@ -15,7 +15,9 @@ import logging
 from contextlib import asynccontextmanager
 
 from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
 from fastapi.middleware.cors import CORSMiddleware
+from sqlalchemy import text
 
 # 导入配置（读取环境变量）
 from app.config import settings
@@ -514,6 +516,79 @@ def create_app() -> FastAPI:
         """
         return {"status": "ok", "service": "wecom-it-smart-desk"}
 
+    @app.get("/ready", tags=["系统"])
+    async def readiness_check():
+        """就绪检查端点。
+
+        检查服务依赖（DB + Redis），不调用企微 API（避免阻塞）。
+        用于 K8s readinessProbe。
+        """
+        try:
+            # 检查数据库
+            from app.database import engine
+            async with engine.connect() as conn:
+                await conn.execute(text("SELECT 1"))
+            db_status = "ok"
+        except Exception as e:
+            db_status = f"error: {str(e)}"
+
+        try:
+            # 检查 Redis
+            from app.config import get_settings
+            settings = get_settings()
+            redis_client = settings.create_redis_client()
+            await redis_client.ping()
+            redis_status = "ok"
+        except Exception as e:
+            redis_status = f"error: {str(e)}"
+
+        if db_status == "ok" and redis_status == "ok":
+            return {"status": "ready", "db": db_status, "redis": redis_status}
+        else:
+            return JSONResponse(
+                status_code=503,
+                content={"status": "not_ready", "db": db_status, "redis": redis_status}
+            )
+
+    @app.get("/metrics", tags=["系统"])
+    async def metrics():
+        """指标端点。
+
+        返回服务运行指标，用于 Prometheus 采集。
+        """
+        import psutil
+
+        return {
+            "status": "ok",
+            "metrics": {
+                "cpu_percent": psutil.cpu_percent(interval=0.1),
+                "memory_percent": psutil.virtual_memory().percent,
+                "disk_percent": psutil.disk_usage("/").percent,
+            }
+        }
+
+    @app.get("/version", tags=["系统"])
+    async def version():
+        """版本信息端点。
+
+        返回服务版本信息。
+        """
+        import subprocess
+        try:
+            git_hash = subprocess.check_output(
+                ["git", "rev-parse", "HEAD"],
+                cwd=app_root,
+                text=True
+            ).strip()[:8]
+        except Exception:
+            git_hash = "unknown"
+
+        return {
+            "service": "wecom-it-smart-desk",
+            "version": "1.1.0",
+            "build": git_hash,
+        }
+
     # ----------------------------------------------------------------------
     # 打印所有已注册的路由（调试用）
     # ----------------------------------------------------------------------