Sub2API v1.0 - AI API 网关（二开初始版本，基于上游 Wei-Shaw/sub2api）

backend/scripts/finalize-ingress-reject-cleanup.sql

@@ -0,0 +1,23 @@
+-- Post-rollout finalizer for ingress-rejection log cleanup.
+--
+-- DO NOT run this during a rolling deployment. Run it only after:
+--   1. every application instance is on the release that no longer reads or
+--      writes deleted_api_key_audits and the deprecated ops_error_logs columns;
+--   2. cleanup-ingress-reject-logs has been dry-run and, if desired, executed;
+--   3. a database backup or recovery point has been verified.
+
+BEGIN;
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DROP TABLE IF EXISTS deleted_api_key_audits;
+
+ALTER TABLE IF EXISTS ops_error_logs
+    DROP COLUMN IF EXISTS attempted_key_prefix,
+    DROP COLUMN IF EXISTS deleted_key_owner_user_id,
+    DROP COLUMN IF EXISTS deleted_key_name;
+
+COMMIT;
+
+-- Run this separately during a normal maintenance window:
+-- VACUUM (ANALYZE) ops_error_logs;

backend/scripts/resolve-version.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+BACKEND_DIR="$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)"
+REPO_DIR="$(CDPATH= cd -- "$BACKEND_DIR/.." && pwd)"
+VERSION_FILE="$BACKEND_DIR/cmd/server/VERSION"
+
+# Prefer the exact release tag when building from a tagged checkout so
+# source builds from vX.Y.Z don't inherit the previous VERSION file value.
+if command -v git >/dev/null 2>&1; then
+  TAG="$(
+    git -C "$REPO_DIR" describe --tags --exact-match --match 'v[0-9]*' 2>/dev/null || \
+    git -C "$REPO_DIR" describe --tags --exact-match --match '[0-9]*' 2>/dev/null || \
+    true
+  )"
+  if [ -n "$TAG" ]; then
+    printf '%s\n' "${TAG#v}"
+    exit 0
+  fi
+fi
+
+printf '%s\n' "$(tr -d '\r\n' < "$VERSION_FILE")"