notes: 加一键转飞书文档 (sidecar markdown-to-feishu)

- backend: POST /api/recordings/:id/feishu → 拼 markdown (总结在最上 + 附件链接到转录/录音 + 转写全文) → 写 /data/feishu-tmp/<id>/ → HTTP POST 到 feishu sidecar
- 复用：已有 feishu_doc_id 时 --update 同一个 doc，前端按钮文案变「↻ 重新生成」
- schema 加 feishu_doc_id + feishu_url 两列（ALTER TABLE 兼容旧 db）
- LLM prompt 改：行动项用 markdown checkbox `- [ ] 谁·做什么·何时`
- sidecar apps/notes/feishu: node:20 + python3 + python3-markdown + @larksuite/cli + COPY 自己的 markdown-to-feishu script + FastAPI /convert
- k8s: deployment 加 feishu container 共享 PVC；lark-cli-creds Secret 挂 /root/.lark-cli/config.json
- CI: 主 image --no-cache（cube 规矩），sidecar 保留 layer cache（chromium-free，但 apt/npm 也大）
- 前端: content 头部加「📤 一键转飞书文档」按钮；已转过显示飞书链接 + 按钮变重生成

apps/notes/k8s/all.yaml

@@ -69,6 +69,8 @@ spec:
                 secretKeyRef:
                   name: notes-creds
                   key: llm_token
+            - name: FEISHU_URL
+              value: http://localhost:8002
           readinessProbe:
             httpGet: { path: /healthz, port: http }
             initialDelaySeconds: 1
@@ -83,10 +85,39 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /data
+        - name: feishu
+          image: registry.famzheng.me/mochi/notes-feishu:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8002
+              name: feishu
+          readinessProbe:
+            httpGet: { path: /healthz, port: feishu }
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /healthz, port: feishu }
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          resources:
+            requests: { cpu: 20m, memory: 64Mi }
+            limits:   { cpu: 500m, memory: 384Mi }
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: lark-cli-config
+              mountPath: /root/.lark-cli
+              readOnly: false
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: notes-data
+        - name: lark-cli-config
+          secret:
+            secretName: lark-cli-creds
+            items:
+              - key: config.json
+                path: config.json
 ---
 apiVersion: v1
 kind: Service