feat: 新增生产环境 compose 编排（直连公共 MySQL）

- 新增 docker-compose.production.yml：仅 app + nginx，数据库连公司公共 MySQL，MYSQL_HOST/MYSQL_PASSWORD 必填校验
- 新增 .env.production.example 环境模板，.gitignore 白名单放行
- 修复 docker-compose.self-hosted.yml 漏转发 AI_TAGGING_TOOL 与 WECOM_* 共 7 个环境变量
- 部署指南补充两套编排文件选用说明与生产启动命令；忽略真实账号数据 CSV 防误提交

docker-compose.production.yml

@@ -0,0 +1,57 @@
+# 生产环境编排：只包含 KOC 服务与入口 Nginx，数据库直连公司公共 MySQL。
+# 没有公共 MySQL 可用时，请改用 docker-compose.self-hosted.yml（自带数据库容器）。
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      MYSQL_HOST: ${MYSQL_HOST:?请在环境文件中设置公共 MySQL 主机 MYSQL_HOST}
+      MYSQL_PORT: ${MYSQL_PORT:-3306}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-koc_loop}
+      MYSQL_USER: ${MYSQL_USER:-koc}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?请在环境文件中设置 MYSQL_PASSWORD}
+      UPLOAD_DIR: /data/koc/uploads
+      APP_ORIGIN: ${APP_ORIGIN}
+      KOC_PORTAL_URL: ${KOC_PORTAL_URL}
+      SUPER_ADMIN_USERNAME: ${SUPER_ADMIN_USERNAME}
+      SUPER_ADMIN_PASSWORD: ${SUPER_ADMIN_PASSWORD}
+      ADMIN_INTERNAL_TOKEN: ${ADMIN_INTERNAL_TOKEN}
+      KOC_MCP_API_KEY: ${KOC_MCP_API_KEY}
+      FEISHU_APP_ID: ${FEISHU_APP_ID:-}
+      FEISHU_APP_SECRET: ${FEISHU_APP_SECRET:-}
+      AI_TOOL_CENTER_MCP_URL: ${AI_TOOL_CENTER_MCP_URL:-}
+      AI_TOOL_CENTER_MCP_KEY: ${AI_TOOL_CENTER_MCP_KEY:-}
+      AI_TAGGING_TOOL: ${AI_TAGGING_TOOL:-}
+      WECOM_CORP_ID: ${WECOM_CORP_ID:-}
+      WECOM_AGENT_ID: ${WECOM_AGENT_ID:-}
+      WECOM_SECRET: ${WECOM_SECRET:-}
+      WECOM_ROBOT_WEBHOOK: ${WECOM_ROBOT_WEBHOOK:-}
+      WECOM_NOTIFY_DUE_DAYS: ${WECOM_NOTIFY_DUE_DAYS:-}
+      WECOM_NOTIFY_ENABLED: ${WECOM_NOTIFY_ENABLED:-}
+      ENABLE_SCHEDULER: ${ENABLE_SCHEDULER:-true}
+      SEED_DEMO_DATA: ${SEED_DEMO_DATA:-false}
+      TZ: Asia/Shanghai
+    volumes:
+      - upload_data:/data/koc/uploads
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))\""]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 45s
+
+  nginx:
+    build:
+      context: .
+      dockerfile: deploy/nginx/Dockerfile
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT:-80}:80"
+    depends_on:
+      app:
+        condition: service_healthy
+
+volumes:
+  upload_data: