feat: verify production runtime integrity

deploy/server/README.md

@@ -56,7 +56,7 @@ python3 -m json.tool /var/lib/data-terminal-cloud-monitor/status.json
 
 监测任务每五分钟执行，正常状态为`healthy`。默认`HOST_DEPLOYMENT_PROFILE=demo`，要求两个模拟服务完整运行；切到`production`后则要求模拟服务全部停止。它还要求宿主机所有非回环TCP监听只能使用22、80和443，避免安全组误放行与错误容器端口映射叠加后暴露数据库或缓存。默认只记录结构化状态和systemd日志；在`/etc/data-terminal-cloud/monitor.env`配置`ALERT_WEBHOOK_URL`后，状态变化会发送带时间戳和HMAC-SHA256签名的JSON通知。完整检查项、签名规则、阈值和失败分支见[《单机云端健康监测与告警手册》](../../docs/server-health-monitoring.md)。
 
-生产候选不能只修改部署模式。生产验收快照同时要求：`HOST_DEPLOYMENT_PROFILE=production`、OSS异地备份最近一次上传与回读验证成功、真实外部告警接收器已配置、`mock-provider`和`mock-alert-receiver`均不运行。任一条件缺失都会阻断生产基础设施门禁，但不会影响`LAB`或`STAGING`联调。
+生产候选不能只修改部署模式。生产验收快照同时要求：`HOST_DEPLOYMENT_PROFILE=production`；API、Callbacks和Worker实际容器`APP_ENV=prod`；Keycloak不使用`start-dev`；OSS异地备份最近一次上传与回读验证成功；真实外部告警接收器已配置；`mock-provider`和`mock-alert-receiver`均不运行。任一条件缺失都会阻断生产基础设施门禁，但不会影响`LAB`或`STAGING`联调。当前Compose覆盖层固定为演示用途，不能通过改标签升级成生产部署。
 
 ## OSS异地备份适配
 

deploy/server/health-monitor.sh

@@ -154,6 +154,46 @@ for service in "${required_services[@]}"; do
   fi
 done
 
+application_environments=()
+application_environment_missing=false
+for application_service in api callbacks worker; do
+  application_container=$("${compose[@]}" ps -q "$application_service")
+  if [[ -z "$application_container" ]]; then
+    application_environment_missing=true
+    continue
+  fi
+  application_environment=$(docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' "$application_container" | sed -n 's/^APP_ENV=//p' | head -n1)
+  if [[ -z "$application_environment" ]]; then
+    application_environment_missing=true
+  else
+    application_environments+=("$application_environment")
+  fi
+done
+if [[ "$application_environment_missing" == true || ${#application_environments[@]} -ne 3 ]]; then
+  record_check application_environment critical missing
+elif [[ "${application_environments[0]}" != "${application_environments[1]}" || "${application_environments[0]}" != "${application_environments[2]}" ]]; then
+  record_check application_environment critical mixed
+elif [[ "$deployment_profile" == production && "${application_environments[0]}" != prod ]]; then
+  record_check application_environment critical "${application_environments[0]}"
+elif [[ "$deployment_profile" == demo && "${application_environments[0]}" != local ]]; then
+  record_check application_environment critical "${application_environments[0]}"
+else
+  record_check application_environment healthy "${application_environments[0]}"
+fi
+
+keycloak_container=$("${compose[@]}" ps -q keycloak)
+if [[ -z "$keycloak_container" ]]; then
+  record_check identity_service_mode critical missing
+elif docker inspect -f '{{json .Config.Cmd}}' "$keycloak_container" | grep -q 'start-dev'; then
+  if [[ "$deployment_profile" == production ]]; then
+    record_check identity_service_mode critical development
+  else
+    record_check identity_service_mode healthy development
+  fi
+else
+  record_check identity_service_mode healthy hardened
+fi
+
 mock_services_running=()
 for mock_service in mock-provider mock-alert-receiver; do
   mock_container=$("${compose[@]}" ps -q "$mock_service")