feat: deploy/deploy.sh 自动化部署体系 — 双tag镜像/快照/迁移门控/回滚，退役根deploy.sh

- compose 四服务补 image: ${BACKEND_TAG}/${FRONTEND_TAG} 插值（换 tag 回滚前提）
- deploy/deploy.sh：工作区校验→PREV_SHA→pull→predeploy 快照(-Fc)→destructive 判定→
  build+双tag→.pending-deploy→迁移退出码门控→up -d --no-deps→健康轮询→versions.log→
  镜像治理；支持 --dry-run / flock / 基础设施健康门 / 多head预检
- deploy/rollback.sh：双入口（手动读 versions.log 跳 ROLLBACK 行 / --auto 读
  .pending-deploy）；destructive 走 pg_restore --clean；双 tag 原子切换
- deploy/hotfix.sh：紧急单文件 cp + 强制收口提醒
- .gitignore 补 .pending-deploy/versions.log（运行时状态）
- 退役根 deploy.sh + deploy.env.example（SSH 旧模型，被 deploy/deploy.sh 取代）

docker-compose.prod.yml

@@ -111,6 +111,7 @@ services:
         max-file: "3"
 
   migrate:
+    image: scilit/backend:${BACKEND_TAG:-latest}
     build: ./backend
     networks:
       - scilit
@@ -126,6 +127,7 @@ services:
     restart: "no"
 
   backend:
+    image: scilit/backend:${BACKEND_TAG:-latest}
     build: ./backend
     networks:
       - scilit
@@ -185,6 +187,7 @@ services:
         max-file: "3"
 
   worker:
+    image: scilit/backend:${BACKEND_TAG:-latest}
     build: ./backend
     networks:
       - scilit
@@ -238,6 +241,7 @@ services:
         max-file: "3"
 
   frontend:
+    image: scilit/frontend:${FRONTEND_TAG:-latest}
     build:
       context: ./frontend
       dockerfile: Dockerfile.prod