fix(deploy): review fixes — smoke photoId field, web healthcheck wget, outbox table name, cdn key shape

Reviewer findings on p5-prep batch:
1. BLOCKING: prod-smoke.sh visibility grep used "id" but API items
   serialize photoId (cn public.service / ov public-ov.service) — every
   healthy deployment would false-FAIL release gate ④. 4 sites fixed.
2. web/web-ov healthchecks used curl on nginx:alpine (absent) → perpetual
   false-unhealthy; switched to busybox wget.
3. RUNBOOK rollback rule cited nonexistent sync_outbox → outbox_events.
4. cdn-checklist invalidation sample key shape aligned to actual
   variantsObjectKey layout (.../albums/{albumId}/variants/{photoId}/{version}/{variant}.jpg).

Co-Authored-By: Claude Code <noreply@anthropic.com>

infra/deploy/RUNBOOK.md

@@ -93,7 +93,7 @@
    ```
 
 3. **数据与同步状态保留原则**（硬性）：
-   - 不清 `sync_outbox` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
+   - 不清 `outbox_events` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
      未确认事件在新一轮推送中按 eventId 幂等重放，水位断层才需要人工补漏
      （对账循环 5min 自动按水位拉 reconcile，无需干预）。
    - 不 `migrate resolve`/手工改 `_prisma_migrations`；异常迁移记录单独记录并