feat: scheduler + CLI + docker-compose + README

M6 — the scheduling/deployment layer. Makes the system runnable as a
scheduled service + deployable via Docker.

Part A — SyncScheduler (app/sync/scheduler.py):
- APScheduler (AsyncIOScheduler) wraps the orchestrator's sync_* functions.
- Daily full sync at FULL_SYNC_HOUR (default 02:00 local) + incremental
  message sync every MESSAGE_INTERVAL_HOURS (default 4).
- ENTITY_FUNCS registry dispatches run_once("<entity>") to the right runner
  (departments/accounts/friends/groups/voice_calls/phone_calls/sms/messages/
  all_wechat/all).
- Conversations for the message run are discovered from the local customer
  mirror (no extra upstream call).
- Failure policy: every run is wrapped — a blown entity is logged + swallowed
  so the scheduler keeps its next appointment.
- Per-run JSON-line log (level=info/warning/error, totals, failed entities).

Part B — CLI entry point (app/sync/cli.py):
- `python -m app.sync.cli sync [--entity <name>] [--quiet]` — one-shot sync.
- `python -m app.sync.cli scheduler [--full-sync-hour H] [--message-interval-hours N]`
  — long-running scheduler (blocks until SIGINT/SIGTERM).
- Uses _push_settings_into_environ + build_client_from_env (session-cookie
  mode preferred; pcLogin deferred).
- Base.metadata.create_all on every command (fresh-checkout friendly).
- Exit codes: 0 success, 1 generic failure, 2 bad CLI / auth misconfig.

Part C — Docker stack:
- yunke-server/Dockerfile: python:3.12-slim, installs deps + app, single
  image serves both API (uvicorn) + scheduler (CLI).
- yunkes/Dockerfile: multi-stage node:20 build → nginx serves dist/ +
  reverse-proxies /api → backend:8000.
- yunkes/nginx.conf: /api proxy with proxy_buffering off (streaming media),
  SPA fallback, asset caching.
- docker-compose.yml: mysql (8.0, healthcheck, volume) + redis (7-alpine) +
  backend + scheduler + frontend (port 5173 → 80). Env-driven creds + cadence.

Part D — README.md at repo root: dev mode + docker mode quick-start, config
table, architecture overview, current limitations (pcLogin deferred, WA voice/
media deferred, conservative pacing, conversation discovery is local-only).

Verification:
- pytest: 323 passed (was 294; +29 new for scheduler + CLI).
- npm run build: clean.
- python -m app.sync.cli --help: prints usage.
- docker compose config: VALID.

Co-Authored-By: Claude <noreply@anthropic.com>

yunkes/.dockerignore

@@ -0,0 +1,15 @@
+# Build artifacts we never want inside the image.
+node_modules/
+dist/
+.vite/
+
+# Local env — the docker-compose ``environment:`` block injects runtime env.
+.env
+
+# Editor / OS noise.
+.vscode/
+.idea/
+.DS_Store
+
+# Playwright / test scratch.
+.playwright-mcp/

yunkes/Dockerfile

@@ -0,0 +1,34 @@
+# Frontend image: build the SPA with Node, serve the static dist with nginx.
+#
+# Multi-stage so the final image contains ONLY the compiled static assets +
+# nginx — no Node toolchain shipped to production.
+FROM node:20-alpine AS build
+
+WORKDIR /app
+
+# Install deps first (cache-friendly: only re-installs when package*.json
+# changes; node_modules is never copied from the host via .dockerignore).
+COPY package.json package-lock.json* ./
+RUN npm ci --no-audit --no-fund
+
+# Copy sources and build the production bundle into ./dist.
+COPY tsconfig*.json vite.config.ts index.html ./
+COPY public/ ./public/
+COPY src/ ./src/
+RUN npm run build
+
+# --------------------------------------------------------------------------- #
+# Runtime stage: nginx serves the static dist and reverse-proxies /api.
+# --------------------------------------------------------------------------- #
+FROM nginx:1.27-alpine
+
+# Replace the default nginx config with our /api proxy + SPA fallback.
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Copy the build output from the build stage into nginx's html root.
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 80
+
+# nginx foregrounds by default with the ``nginx -g 'daemon off;'`` directive
+# already set on the official image; no CMD override needed.

yunkes/nginx.conf

@@ -0,0 +1,55 @@
+# nginx config for the yunkes frontend container.
+#
+# Two responsibilities:
+#   1. Serve the SPA's static assets (JS/CSS/images) from /usr/share/nginx/html.
+#   2. Reverse-proxy /api to the backend service so the SPA can call the
+#      FastAPI app on the same origin (no CORS gymnastics in prod).
+#
+# The SPA fallback (try_files ... /index.html) lets vue-router own deep
+# links — a refresh on /customers hits index.html and is resolved client-side.
+
+server {
+    listen       80;
+    server_name  _;
+
+    root   /usr/share/nginx/html;
+    index  index.html;
+
+    # Gzip text-y responses — meaningful for the (sizeable) JS bundle.
+    gzip on;
+    gzip_types text/plain text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+
+    # API reverse proxy. ``backend`` resolves via docker-compose's default
+    # network; if the name changes, update here. Streaming endpoints
+    # (/api/media/) work without buffering because we turn proxy_buffering
+    # off — matches the dev-server behaviour (vite proxies /api/media first).
+    location /api/ {
+        proxy_pass         http://backend:8000;
+        proxy_http_version 1.1;
+        proxy_set_header   Host              $host;
+        proxy_set_header   X-Real-IP         $remote_addr;
+        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header   X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+        # Allow websocket-style upgrades (harmless no-op for plain HTTP APIs
+        # but cheap insurance against future ws use).
+        proxy_set_header   Upgrade           $http_upgrade;
+        proxy_set_header   Connection        "upgrade";
+        # Disable buffering so /api/media/{hash} streams straight through.
+        proxy_buffering    off;
+    }
+
+    # Static SPA assets — long cache (immutable content hash in filename).
+    location ~* \.(?:js|css|woff2?|png|jpe?g|gif|svg|ico)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    # SPA fallback: any path that isn't a real file resolves to index.html
+    # so vue-router can pick it up.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}