chore(dev): H5 dev-stack fixes + revert temp Dify key

dev compose: 挂载 public/ (缺 duckula.webp 导致应用无法挂载)、vite proxy 目标改 VITE_PROXY_TARGET (容器内 localhost 非后端)、CSP 增加 ws://localhost:8000 (dev WS 端口)；并还原 Dify key 临时切换 (app-J3s8sHarZQ2SCaNF3xCppliL 经 dify2openai 返回空 SSE，本地 typewriter 主路径需改用 backend/.env 工作 app 才能验证)。

docker-compose.dev.yml

@@ -6,11 +6,12 @@
 # 用法:
 #   1. cp .env.example .env.dev (编辑填值,或直接用 .env.dev 模板)
 #   2. docker compose -f docker-compose.dev.yml up -d
-#   3. 前端 4 端各跑 pnpm dev(Vite proxy /api → backend:8000)
+#   3. 访问 http://localhost:80/itdesk/ 等
 # 启动后:
-#   - Backend:  http://localhost:8000  (Swagger: /docs)
+#   - Nginx:     http://localhost:80      (统一入口)
-#   - Postgres: localhost:5432
+#   - Postgres:  localhost:5432
-#   - Redis:    localhost:6379
+#   - Redis:     localhost:6379
+#   - Backend:   localhost:8000 (可选)
 # =============================================================================
 
 services:
@@ -26,7 +27,7 @@ services:
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-wecom_dev}
       POSTGRES_DB: ${POSTGRES_DB:-wecom_it_desk_dev}
     ports:
-      - "5432:5432"          # 暴露到宿主机,方便用 Navicat/psql 连
+      - "5432:5432"
     volumes:
       - postgres_dev_data:/var/lib/postgresql/data
     healthcheck:
@@ -57,49 +58,176 @@ services:
     networks:
       - dev-net
 
+  # --------------------------------------------------------------------------
+  # Neo4j 5 — 知识图谱存储
+  # --------------------------------------------------------------------------
+  neo4j:
+    image: neo4j:5-community
+    container_name: dev_wecom_neo4j
+    restart: unless-stopped
+    environment:
+      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-password}
+      NEO4J_PLUGINS: '["apoc"]'
+    ports:
+      - "7474:7474"
+      - "7687:7687"
+    volumes:
+      - neo4j_dev_data:/data
+      - neo4j_dev_logs:/logs
+    healthcheck:
+      test: ["CMD-SHELL", "cypher-shell -u neo4j -p ${NEO4J_PASSWORD:-password} 'RETURN 1'"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks:
+      - dev-net
+
   # --------------------------------------------------------------------------
   # Backend — 开发模式(代码 volume mount + uvicorn --reload)
   # --------------------------------------------------------------------------
   backend:
     build:
       context: ./backend
-      dockerfile: Dockerfile.dev      # dev 版(无需 apt 装 gcc,快)
+      dockerfile: Dockerfile.dev
     image: wecom-it-desk-backend:dev
     container_name: dev_wecom_backend
     restart: unless-stopped
     env_file:
       - .env.dev
     environment:
-      # 容器内用 service name(host 是 localhost,容器内是 postgres/redis)
+      - DATABASE_URL=postgresql://wecom:wecom_dev@postgres:5432/wecom_it_desk_dev
-      - DATABASE_URL=postgresql://${POSTGRES_USER:-wecom}:${POSTGRES_PASSWORD:-wecom_dev}@postgres:5432/${POSTGRES_DB:-wecom_it_desk_dev}
       - REDIS_URL=redis://redis:6379/0
-      - DEV_MODE=true                 # 开启 Mock 企微 OAuth
+      - DEV_MODE=true
-      - CORS_ORIGINS=http://localhost:5173,http://localhost:5174,http://localhost:5175,http://localhost:5176
+      - WECOM_SSO_CALLBACK_BASE=http://localhost:80
-      # PYTHONPATH 必须含 /app,否则 alembic upgrade head 跑 env.py 时
+      - CORS_ORIGINS=http://localhost:80
-      # `from app.config import settings` 会 ModuleNotFoundError
+      # Dify AI 服务（生产环境）
-      # (alembic 1.13+ 不再默认 prepend cwd 到 sys.path)
+      # 注意：dev 栈用的 app-J3s8sHarZQ2SCaNF3xCppliL 经 dify2openai 代理返回空 SSE（delta:{}），
+      # 因此本地 dev 的 AI 打字机主路径无法验证（需改用 backend/.env 中的工作 app 才能看到流式效果）。
+      - DIFY_API_URL=http://yw-dify.dc.servyou-it.com/dify2openai/v1/chat/completions
+      - DIFY_API_KEY=app-J3s8sHarZQ2SCaNF3xCppliL
+      - DIFY_TIMEOUT=30
       - PYTHONPATH=/app
+      # Neo4j 知识图谱
+      - NEO4J_URI=bolt://neo4j:7687
+      - NEO4J_USER=neo4j
+      - NEO4J_PASSWORD=${NEO4J_PASSWORD:-password}
+      - NEO4J_DATABASE=neo4j
     ports:
-      - "8000:8000"                   # 暴露到宿主机
+      - "8000:8000"
     volumes:
-      # 关键:volume mount 源码,改代码自动 reload
       - ./backend/app:/app/app
       - ./backend/alembic:/app/alembic
       - ./backend/scripts:/app/scripts
     command: >
-      sh -c "alembic upgrade head &&
+      sh -c "uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
-             uvicorn app.main:app --host 0.0.0.0 --port 8000 --reload"
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
+      neo4j:
+        condition: service_healthy
+    networks:
+      - dev-net
+
+  # --------------------------------------------------------------------------
+  # Frontend-Agent — 坐席前端开发模式
+  # --------------------------------------------------------------------------
+  frontend-agent:
+    build:
+      context: ./frontend-agent
+      dockerfile: Dockerfile.dev
+    image: wecom-it-desk-agent:dev
+    container_name: dev_wecom_frontend_agent
+    restart: unless-stopped
+    environment:
+      - VITE_API_BASE=http://localhost:80/api
+      - VITE_WS_BASE=ws://localhost:80/ws
+    ports:
+      - "5173:5173"
+    volumes:
+      - ./frontend-agent/src:/app/src
+    depends_on:
+      - backend
+    networks:
+      - dev-net
+
+  # --------------------------------------------------------------------------
+  # Frontend-H5 — H5前端开发模式
+  # --------------------------------------------------------------------------
+  frontend-h5:
+    build:
+      context: ./frontend-h5
+      dockerfile: Dockerfile.dev
+    image: wecom-it-desk-h5:dev
+    container_name: dev_wecom_frontend_h5
+    restart: unless-stopped
+    environment:
+      - VITE_API_BASE=http://localhost:80/api
+      - VITE_WS_BASE=ws://localhost:80/ws
+      # dev 容器内 Vite 代理目标：指向 compose 服务名 backend（容器内 localhost 不是后端）
+      - VITE_PROXY_TARGET=http://backend:8000
+    ports:
+      - "5174:5174"
+    volumes:
+      - ./frontend-h5/src:/app/src
+      # dev 热更新：同时挂载 public/，否则容器镜像内烘焙的 public/ 不含后续新增资源
+      # （如 duckula.webp），导致 Vite 解析 <img src="/duckula.webp"> 失败、整个应用无法挂载
+      - ./frontend-h5/public:/app/public
+      # 挂载 vite.config.ts 使代理目标等配置可热生效（无需重建镜像）
+      - ./frontend-h5/vite.config.ts:/app/vite.config.ts
+      # 挂载 index.html 使 CSP（含 dev WS 端口）修改可热生效
+      - ./frontend-h5/index.html:/app/index.html
+    depends_on:
+      - backend
+    networks:
+      - dev-net
+
+  # --------------------------------------------------------------------------
+  # Frontend-Admin — 管理前端开发模式
+  # --------------------------------------------------------------------------
+  frontend-admin:
+    build:
+      context: ./frontend-admin
+      dockerfile: Dockerfile.dev
+    image: wecom-it-desk-admin:dev
+    container_name: dev_wecom_frontend_admin
+    restart: unless-stopped
+    environment:
+      - VITE_API_BASE=http://localhost:80/api
+    ports:
+      - "5175:5175"
+    volumes:
+      - ./frontend-admin/src:/app/src
+    depends_on:
+      - backend
+    networks:
+      - dev-net
+
+  # --------------------------------------------------------------------------
+  # Nginx — 反向代理（统一入口）
+  # --------------------------------------------------------------------------
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: dev_wecom_nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+    volumes:
+      - ./nginx/nginx.dev.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - backend
+      - frontend-agent
+      - frontend-h5
+      - frontend-admin
     networks:
       - dev-net
 
 volumes:
   postgres_dev_data:
   redis_dev_data:
+  neo4j_dev_data:
+  neo4j_dev_logs:
 
 networks:
   dev-net: