- explorer.toml: 改为 cluster_native 直连 taosd:6031，注释掉 REST API
- 新增 taosadapter.toml: 独立 REST API 服务配置 (port 6041)
- 新增 start-taos-explorer.sh: bridge 网络，挂载数据目录和配置
- 新增 start-taosadapter.sh: bridge 网络，映射 6041 端口
- 新增 start-tdengine-operator.sh: host 网络，仅启动 taosd
- README.md: 更新容器架构、添加 TDengine 管理说明和架构图

- deploy/README.md:
  - 安装目录 /opt/iot-platform -> /mnt/iot-platform
  - 网络模式 host -> bridge，新增端口映射说明
  - 去掉自动回滚描述，改为保留容器排查
  - 新增容器架构表格和 TDengine 配置文件说明

- CLAUDE.md:
  - Redis host: localhost -> ${REDIS_HOST:localhost}
  - TDengine URL: 127.0.0.1 -> 172.21.185.173
  - 环境变量示例添加 REDIS_HOST

网络架构:
- iot-platform: host -> bridge (新增 -p 8887:8887 端口映射)
- taos-explorer: bridge (新增 /mnt/taos-explorer-data 数据持久化)
- tdengine-operator: 保持 host 网络

配置更新:
- TDengine URL: 127.0.0.1 -> 172.21.185.173 (宿主机内网 IP)
- Redis host: localhost -> ${REDIS_HOST:localhost} 环境变量
- taos.cfg fqdn: 127.0.0.1 -> 172.21.185.173
- explorer.toml cluster: localhost -> 172.21.185.173

部署脚本:
- REMOTE_DIR: /opt/iot-platform -> /mnt/iot-platform
- 日志目录: /opt/iot-platform/logs -> /mnt/iot-platform/logs
- 去掉自动回滚逻辑，保留容器用于排查
- 新增 -p 8887:8887 端口映射

新增服务器配置文件到仓库:
- deploy/Dockerfile
- deploy/start-container.sh
- deploy/config/taos.cfg
- deploy/config/explorer.toml
- deploy/config/tdengine-explorer.conf
- .env (移除 .gitignore 忽略)

- deploy/README.md: systemd → Podman 容器化部署
- CLAUDE.md: 更新部署命令、TDengine URL、.env 加载方式

- 停止/启动 systemd 服务 → 停止/启动 Podman 容器
- 部署时自动构建容器镜像
- 回滚逻辑同步改为容器方式

When --no-rollback is set, the script keeps the new version on the
server even if health check fails, making it possible to inspect
startup logs via journalctl to diagnose the issue.

Security (P0):
- Remove hardcoded MySQL password from SysrealtimeService
- Add table name whitelist validation (regex + length limit)
- Validate ${tableName} in SysrealtimeMapper.xml
- Externalize all credentials to .env file
- Fix unbounded thread pools in MQTT consumers
- Fix mysqlWritePool leak in MqttFaultConsumer

Quality (P1):
- Extract AbstractMqttConsumer base class (-500+ duplicate lines)
- Refactor VehicleSyncTask: SCAN instead of KEYS, batch ops,
  RestTemplate timeout, loop-invariant extraction
- Add unit tests (RedisKeys, SysrealtimeService, MqttConsumer)

Architecture (P2):
- Add Spring Boot Actuator (/actuator/health)
- Create RedisKeys constants class for key namespace
- Add .env.example and start.sh for local development

Deployment:
- Add systemd service (iot-platform.service)
- Add deploy.sh with build, upload, backup, health check, rollback
- Add setup-server.sh for server initialization
- Add health-check.sh (Actuator + TCP port fallback)

Docs:
- Update CLAUDE.md for standalone iot-platform architecture
- Update README.md with build/deploy instructions
- Add deploy/README.md