v0.8.0-alpha.2 - Media storage and release hardening

Highlights

• add S3-compatible product media storage while preserving stable /api/media URLs and local-volume defaults
• include S3 media objects in encrypted backup and restore workflows
• add SKU migration verification and rollback guidance
• pin and checksum CI security scanners, scan full Git history, and allow cold-cache Trivy runs
• apply current Debian security updates to application and MySQL runtime images
• restore all CI jobs to standard GitHub-hosted ubuntu-latest runners

Validation

• PR #53 completed all backend, frontend, configuration, source security, image security and full-stack E2E checks
• PR #54 and the resulting main commit both completed all 13 GitHub-hosted CI jobs
• merchant-to-customer Playwright flow and dependency/service recovery drills passed

Upgrade notes

• ./start.sh upgrade v0.8.0-alpha.2 creates an encrypted backup before rebuilding and switching application images
• local media remains the default unless MEDIA_STORAGE_TYPE=s3 and the required S3 settings are configured
• review docs/SKU迁移与回滚手册.md before any manual database rollback

Known limitations

• pre-release only: real merchant pilot, public-domain TLS acceptance and external alert delivery remain deployment-specific work
• COD/OFFLINE only; no online payment gateway or reconciliation