fix(deploy): review fixes — smoke photoId field, web healthcheck wget, outbox table name, cdn key shape

Reviewer findings on p5-prep batch:
1. BLOCKING: prod-smoke.sh visibility grep used "id" but API items
   serialize photoId (cn public.service / ov public-ov.service) — every
   healthy deployment would false-FAIL release gate ④. 4 sites fixed.
2. web/web-ov healthchecks used curl on nginx:alpine (absent) → perpetual
   false-unhealthy; switched to busybox wget.
3. RUNBOOK rollback rule cited nonexistent sync_outbox → outbox_events.
4. cdn-checklist invalidation sample key shape aligned to actual
   variantsObjectKey layout (.../albums/{albumId}/variants/{photoId}/{version}/{variant}.jpg).

Co-Authored-By: Claude Code <noreply@anthropic.com>

infra/deploy/RUNBOOK.md

@@ -93,7 +93,7 @@
    ```
 
 3. **数据与同步状态保留原则**（硬性）：
-   - 不清 `sync_outbox` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
+   - 不清 `outbox_events` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
      未确认事件在新一轮推送中按 eventId 幂等重放，水位断层才需要人工补漏
      （对账循环 5min 自动按水位拉 reconcile，无需干预）。
    - 不 `migrate resolve`/手工改 `_prisma_migrations`；异常迁移记录单独记录并

infra/deploy/cdn-checklist.md

@@ -95,8 +95,8 @@
 # 多 URL 用换行分隔（RefreshObjectCatches/PreloadObjectCaches 的 ObjectPath 约定）
 aliyun cdn RefreshObjectCaches \
   --ObjectPath "$(printf '%s\n%s' \
-    'https://<图片域名>/variants/thumb/<photoId>/<版本>.webp' \
+    'https://<图片域名>/photo-live/prod/albums/<albumId>/variants/<photoId>/<version>/thumb.jpg' \
-    'https://<图片域名>/variants/browse/<photoId>/<版本>.webp')" \
+    'https://<图片域名>/photo-live/prod/albums/<albumId>/variants/<photoId>/<version>/browse.jpg')" \
   --ObjectType File
 
 # 新活动发布 → 预热首页与首屏静态资源（viewer 域名，降低冷缓存首访时延）

infra/deploy/docker-compose-ov.yml

@@ -43,7 +43,7 @@ services:
     depends_on:
       api-ov: { condition: service_healthy }
     healthcheck:
-      test: ["CMD", "curl", "-fs", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-qO", "/dev/null", "http://127.0.0.1/"]
       interval: 30s
       timeout: 5s
       retries: 5

infra/deploy/docker-compose.cn.yml

@@ -72,7 +72,7 @@ services:
     depends_on:
       api-cn: { condition: service_healthy }
     healthcheck:
-      test: ["CMD", "curl", "-fs", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-qO", "/dev/null", "http://127.0.0.1/"]
       interval: 30s
       timeout: 5s
       retries: 5

scripts/prod-smoke.sh

@@ -156,12 +156,12 @@ fi
 
 echo "-- ④ 公开读轮询至可见（≤${WAIT_SECONDS}s；worker 变体流水线 + 发布事务为异步）"
 if [ "$DRY_RUN" -eq 1 ]; then
-  echo "  轮询 GET $BASE_CN/v1/public/albums/$PUBLIC_TOKEN/photos（间隔 2s）直到响应含 \"id\":\"$PHOTO_ID\""
+  echo "  轮询 GET $BASE_CN/v1/public/albums/$PUBLIC_TOKEN/photos（间隔 2s）直到响应含 \"photoId\":\"$PHOTO_ID\""
 else
   SEEN_CN=0; WAITED=0
   while [ "$WAITED" -le "$WAIT_SECONDS" ]; do
     http GET "$BASE_CN/v1/public/albums/$PUBLIC_TOKEN/photos" 200 || true
-    if [ -n "$PHOTO_ID" ] && printf '%s' "$BODY" | grep -q "\"id\":\"$PHOTO_ID\""; then SEEN_CN=1; break; fi
+    if [ -n "$PHOTO_ID" ] && printf '%s' "$BODY" | grep -q "\"photoId\":\"$PHOTO_ID\""; then SEEN_CN=1; break; fi
     sleep 2; WAITED=$((WAITED + 2))
   done
   if [ "$SEEN_CN" -eq 1 ]; then step_pass "cn 公开可见（${WAITED}s）"; else step_fail "cn 公开可见超时 ${WAIT_SECONDS}s（查 worker 日志）"; fi
@@ -170,12 +170,12 @@ fi
 if [ "$SKIP_OV" -eq 0 ]; then
   echo "-- ④' ov 侧公开读确认（cn→ov 同步：推送 2s 间隔 + 对账 5min 兜底）"
   if [ "$DRY_RUN" -eq 1 ]; then
-    echo "  轮询 GET $BASE_OV/v1/public/albums/$PUBLIC_TOKEN/photos（间隔 2s）直到响应含 \"id\":\"$PHOTO_ID\""
+    echo "  轮询 GET $BASE_OV/v1/public/albums/$PUBLIC_TOKEN/photos（间隔 2s）直到响应含 \"photoId\":\"$PHOTO_ID\""
   else
     SEEN_OV=0; WAITED=0
     while [ "$WAITED" -le "$WAIT_SECONDS" ]; do
       http GET "$BASE_OV/v1/public/albums/$PUBLIC_TOKEN/photos" 200 || true
-      if [ -n "$PHOTO_ID" ] && printf '%s' "$BODY" | grep -q "\"id\":\"$PHOTO_ID\""; then SEEN_OV=1; break; fi
+      if [ -n "$PHOTO_ID" ] && printf '%s' "$BODY" | grep -q "\"photoId\":\"$PHOTO_ID\""; then SEEN_OV=1; break; fi
       sleep 2; WAITED=$((WAITED + 2))
     done
     if [ "$SEEN_OV" -eq 1 ]; then step_pass "ov 公开可见（同步链路端到端，${WAITED}s）"; else step_fail "ov 公开可见超时 ${WAIT_SECONDS}s（查 sync 日志 / RUNBOOK §5.1）"; fi