notes: 新建 notes.famzheng.me — 录音 → ASR → LLM 会议纪要

- 后端 axum + sqlite (recordings 表)：上传 multipart 流式落 PVC；spawn worker pending → transcribing (调 mochi 那边 ASR endpoint, fireredasr2 token, Whisper-style multipart) → summarizing (调 gemma-4-31b-it OpenAI 兼容接口) → done
- 鉴权 middleware：Authorization: token <PASSPHRASE>；audio 流播放 ?token= query 兜底；passphrase 走 k8s Secret 不写死
- 前端 Vue3：首次访问弹 passphrase modal；sidebar 录音列表（带状态 chip）+ content 选中显示音频 + 转写 + markdown 纪要；5s polling 进度
- k8s manifest: ns cube-notes / PVC 30Gi / Ingress notes.famzheng.me / bodylimit 600M；Secret notes-creds = {passphrase, asr_token, llm_token}
- portal apps.ts 加 notes entry

.gitea/workflows/deploy-notes.yml

@@ -0,0 +1,55 @@
+name: deploy notes
+# notes.famzheng.me — 录音 → ASR → LLM 会议纪要
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'apps/notes/**'
+      - 'crates/cube-core/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.gitea/workflows/deploy-notes.yml'
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    env:
+      APP: notes
+      NS: cube-notes
+      IMAGE: registry.famzheng.me/mochi/notes
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve image tag
+        id: tag
+        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Build rust (musl static)
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo build --release --target x86_64-unknown-linux-musl -p "$APP"
+
+      - name: Build frontend
+        run: |
+          cd "apps/$APP/frontend"
+          npm ci
+          npm run build
+
+      - name: Build & push image
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          echo "$REGISTRY_TOKEN" | docker login registry.famzheng.me -u mochi --password-stdin
+          # --no-cache 必须 —— 见 memory/feedback_cube_docker_cache.md
+          docker build --no-cache -f "apps/$APP/Dockerfile" -t "$IMAGE:${{ steps.tag.outputs.sha }}" .
+          docker push "$IMAGE:${{ steps.tag.outputs.sha }}"
+
+      - name: Initialize K8s resources
+        run: kubectl apply -f apps/notes/k8s/all.yaml
+
+      - name: Roll out to k3s
+        run: |
+          kubectl -n "$NS" set image "deploy/$APP" "$APP=$IMAGE:${{ steps.tag.outputs.sha }}"
+          kubectl -n "$NS" rollout status "deploy/$APP" --timeout=120s