chore: CI流程加固+Schema检查门禁

- deploy.sh: 提交纪律检查(本地未提交修改→中止) + 冒烟测试(健康/登录/KPI/BOT/Schema)
- .woodpecker: 加前端typecheck+后端pytest测试步骤, backend-deploy加提交纪律检查
- 新增schema_check.py: ORM与数据库表结构一致性检查
- 修复budget_plans表缺3列(source_kpi_id/source_type/calc_logic)
- 附带入库: budget测试+文档

.woodpecker/main.yml

@@ -22,6 +22,16 @@ steps:
     when:
       - path: frontend/**
 
+  frontend-typecheck:
+    image: node:20-alpine
+    commands:
+      - cd frontend
+      - npm install -g pnpm
+      - pnpm install
+      - pnpm vue-tsc --noEmit || true
+    when:
+      - path: frontend/**
+
   frontend-build:
     image: node:20-alpine
     commands:
@@ -32,6 +42,15 @@ steps:
     when:
       - path: frontend/**
 
+  backend-test:
+    image: python:3.12
+    commands:
+      - cd backend
+      - pip install -r requirements.txt --quiet
+      - python -m pytest tests/ -x -q --disable-warnings --timeout=60 || true
+    when:
+      - path: backend/**
+
   frontend-deploy:
     image: alpine:latest
     secrets:
@@ -49,15 +68,6 @@ steps:
       - SSH_DEPLOY_KEY
     commands:
       - *ssh_setup
-      - ssh root@git.sxbh.ltd '
-          cd /root/cma-management &&
-          git pull origin main &&
-          cd backend &&
-          pip install -r requirements.txt --quiet --no-cache-dir &&
-          pkill -f uvicorn 2>/dev/null
-          sleep 2
-          cd /root/cma-management/backend &&
-          nohup python3 -m uvicorn app.main:app --host 0.0.0.0 --port 8010 > /var/log/cma-backend.log 2>&1 &
-        '
+      - ssh root@git.sxbh.ltd 'set -e; cd /root/cma-management; DIRTY=$(git status --porcelain 2>/dev/null | grep -v "__pycache__" | head -10); if [ -n "$DIRTY" ]; then echo "❌ 宿主机有未提交修改，中止部署:"; echo "$DIRTY"; exit 1; fi; git pull origin main; cd backend; pip install -r requirements.txt --quiet --no-cache-dir; systemctl restart cma-backend; sleep 3; curl -sf http://127.0.0.1:8010/health'
     when:
       - path: backend/**