完善设备端体验与微信校验支持

docs/architecture/07-deployment.md

@@ -0,0 +1,60 @@
+# Deployment
+
+## Public Deployment Shape
+
+```mermaid
+flowchart TD
+  User["WeChat mini-program user"]
+  Domain["banban.api.talkingq.com"]
+  Nginx["Nginx container\nTLS + reverse proxy + static verify files"]
+  FastAPI["talkingq-url FastAPI process\n/home/ubuntu/banban-backend"]
+  MySQL["1Panel MySQL container\nMySQL 8.x"]
+  MQTT["Configured MQTT broker"]
+  COS["Tencent COS"]
+  Certbot["certbot container\nLet's Encrypt renewals"]
+
+  User -->|HTTPS| Domain --> Nginx --> FastAPI
+  FastAPI --> MySQL
+  FastAPI --> MQTT
+  FastAPI --> COS
+  Certbot --> Nginx
+```
+
+## Startup Responsibilities
+
+```mermaid
+sequenceDiagram
+  autonumber
+  participant Proc as FastAPI process
+  participant Init as init_db
+  participant Scheduler as TaskScheduler
+  participant MQTT as TalkingQMQTTService
+  participant Roles as role_manager
+  participant Firmware as firmware_scanner
+
+  Proc->>Init: initialize and migrate database tables
+  Proc->>Scheduler: start periodic tasks
+  Proc->>MQTT: connect to configured broker
+  Proc->>Roles: initialize role definitions
+  Proc->>Firmware: scan firmware files
+  Proc-->>Proc: serve API routes and assets
+```
+
+## Deployment Notes
+
+- The mini-program production API base should resolve to
+  `https://banban.api.talkingq.com`.
+- WeChat legal domains must include the API host and any audio/COS download
+  domains used by `mediaUrl`.
+- MySQL table shape should be checked against the live database before direct
+  data work, because deployment state can drift from local schema files.
+- Device identity data should normally enter through `device_imei_mapping`;
+  `device_auth` is activated by device bootstrap unless a deliberate pre-activation
+  path is required.
+
+## Source Anchors
+
+- Docker/Nginx assets: `talkingq-url/docker-compose.yml`, `talkingq-url/nginx.conf`
+- Runtime startup: `talkingq-url/main.py`
+- Database initialization: `talkingq-url/database/init_db.py`
+- Mini-program API config: `banban-mini/config/prod.js`, `banban-mini/src/config/env.ts`