docs(部署方案): 同步 NAS+甲骨文反代决策 + 生成部署骨架

- SRS/SDD/README/PROGRESS 统一将部署目标由"美国服务器"更正为"NAS 本机 + 甲骨文服务器反向代理"（此前已确认但未入库）
- 新增 docker-compose.yml / nginx.conf / .env.example（对应待办任务4）
- 相对 SDD 草稿的安全加固：one-api 端口改绑 127.0.0.1（原为公网端口映射），lobe-chat 不再发布主机端口，仅走容器内网

docker-compose.yml

@@ -0,0 +1,66 @@
+version: '3.8'
+
+services:
+  mysql:
+    image: mysql:8.0
+    container_name: one-api-mysql
+    restart: always
+    environment:
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_DATABASE=oneapi
+    volumes:
+      - ./mysql-data:/var/lib/mysql
+    networks:
+      - ai-network
+
+  one-api:
+    image: justsong/one-api:latest
+    container_name: one-api
+    restart: always
+    ports:
+      # 仅绑定 127.0.0.1，不对局域网/公网暴露；远程管理走 SSH 隧道：
+      # ssh -p 2222 -L 3000:127.0.0.1:3000 ericwyuan@192.168.50.64
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - ./one-api-data:/data
+    environment:
+      - SQL_DSN=root:${MYSQL_ROOT_PASSWORD}@tcp(mysql:3306)/oneapi
+      - TZ=Asia/Shanghai
+    depends_on:
+      - mysql
+    networks:
+      - ai-network
+
+  lobe-chat:
+    image: lobehub/lobe-chat:latest
+    container_name: lobe-chat
+    restart: always
+    # 不发布主机端口：仅 Nginx 通过容器网络访问 lobe-chat:3210
+    environment:
+      - OPENAI_API_KEY=${ONE_API_TOKEN}
+      - OPENAI_PROXY_URL=http://one-api:3000/v1
+      - ACCESS_CODE=${LOBE_ACCESS_CODE}
+      - DEFAULT_LANG=zh-CN
+    depends_on:
+      - one-api
+    networks:
+      - ai-network
+
+  nginx:
+    image: nginx:alpine
+    container_name: nginx-proxy
+    restart: always
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./certs:/etc/nginx/certs:ro
+    depends_on:
+      - lobe-chat
+    networks:
+      - ai-network
+
+networks:
+  ai-network:
+    driver: bridge