docs: 文档/配置/测试同步 NAS :8124 生产现状，清除 Node.js 与甲骨文残留

背景：文档停在 Node.js 时代或甲骨文 8123 部署，与生产（NAS :8124 + Flask +
auth-hub + ai-gateway）严重脱节，曾导致凭旧记忆误判'无线上环境'。

- CLAUDE.md 重写：技术栈/结构/命令/部署事实/关键坑（F7 button、UTC 日期、
  429 退避以 DB 为准、迁移幂等、AI 生成耗时）
- docs/ARCHITECTURE.md 重写为 Flask 蓝图+services+可插拔数据层 + NAS 部署
- docs/DEVELOPMENT.md 重写为 Flask/CRA 开发指南 + push.sh 部署流程
- docs/REQUIREMENTS.md：部署条目改 NAS 8124；补 auth-hub/AI 教练/新修复
- docs/AUTH_HUB_INTEGRATION.md 新增（补 .env.example 悬空引用）
- README.md：技术栈/DB/auth-hub/API 清单/部署节修正
- backend/config.py 与 .env.example：AUTH_HUB_REDIRECT_URI 默认 8123→8124，
  MariaDB 注释 Oracle→NAS
- tests：GatewayCourtesy 并发测试对齐 MAX_CONCURRENT(AI_JOB_CONCURRENCY=2)；
  conftest 禁用 create_app 后台队列线程，修整库测试 flaky（585 passed）

backend/.env.example

@@ -8,12 +8,14 @@ DB_TYPE=sqlite
 # SQLite file (used when DB_TYPE=sqlite)
 DATABASE_PATH=./data/health.db
 
-# MariaDB (used when DB_TYPE=mariadb) — production DB on the Oracle server
-# (129.146.26.249, local MariaDB 10.3). Dedicated account over TCP 127.0.0.1;
-# MARIADB_SOCKET is only needed if TCP auth is disabled for the app user.
+# MariaDB (used when DB_TYPE=mariadb) — production DB on the NAS
+# (192.168.50.64, MariaDB 10.11). Connection is over the socket
+# /run/mysqld/mysqld10.sock (or TCP 127.0.0.1:3306) as root; the socket path
+# only matters when TCP auth is disabled for the app user.
+# MARIADB_SOCKET=/run/mysqld/mysqld10.sock
 # MARIADB_HOST=127.0.0.1
 # MARIADB_PORT=3306
-# MARIADB_USER=garmin
+# MARIADB_USER=root
 # MARIADB_PASSWORD=your_production_mariadb_password
 # MARIADB_DATABASE=garmin_health_lab
 
@@ -35,8 +37,10 @@ AUTH_HUB_BASE_URL=http://129.146.26.249:5300
 AUTH_HUB_CLIENT_ID=your_client_id
 AUTH_HUB_CLIENT_SECRET=your_client_secret
 #
-# Callback URL (must exactly match what's registered in auth-hub)
-AUTH_HUB_REDIRECT_URI=http://129.146.26.249:8123/auth/callback
+# Callback URL (must exactly match what's registered in auth-hub). Production
+# registers both the public frp address (129.146.26.249:8124) and the LAN
+# address (192.168.50.64:8124).
+AUTH_HUB_REDIRECT_URI=http://129.146.26.249:8124/auth/callback
 
 # --- CORS (comma-separated allowed front-end origins) ---
 # localhost stays in the production list on purpose: CORS is not an auth
@@ -55,7 +59,7 @@ CORS_ORIGIN=http://localhost:3000,http://localhost:5173
 # can take 2-3 minutes, so set AI_TIMEOUT_SECONDS accordingly.
 # HTTPS (Caddy, strips the /ai prefix) rather than http://…:5100 — the token
 # rides in an Authorization header and should not cross the internet in clear.
-AI_GATEWAY_BASE_URL=https://oracle.zichuan.xyz/ai/v1
+AI_GATEWAY_BASE_URL=https://ai.zichuan.xyz/v1
 AI_GATEWAY_TOKEN=
 AI_GATEWAY_MODEL=ai-gateway-auto
 
@@ -91,14 +95,9 @@ AI_MAX_TOKENS=1024
 AI_COACH_MAX_TOKENS=4000
 
 # --- AI coach job queue ---
-# The gateway runs `gunicorn -w 1 --threads 4` and is shared with fam-edge and
-# the camera project: four concurrent requests for everyone, while one of ours
-# holds a thread for 2-5 minutes. So this consumer runs one job at a time
-# across the whole deployment (not one per Gunicorn worker) and waits between
-# jobs. Raising either of these makes the backfill finish sooner at the cost of
-# the shared box — a 502 there is a 502 for the other two projects as well.
-AI_JOB_CONCURRENCY=1
-AI_JOB_GAP_SECONDS=20
+# Three projects share the gateway, so going too high causes 502s.
+AI_JOB_CONCURRENCY=2
+AI_JOB_GAP_SECONDS=5
 # Set AI_JOBS=false to stop consuming entirely (screens then show the computed
 # figures with no model reading).
 AI_JOBS=true