chore(infra): 更新 Nginx 部署配置与项目上下文文档

- 更新 CI/CD 子域名反向代理配置
- 调整 Nginx 静态文件服务器配置
- 更新 CONTEXT.md 领域共享语言文档
- 添加 CLAUDE.md 代理工作指南
- 更新 Playwright E2E 测试配置

conf.d/ci.f.novalon.cn.conf

@@ -1,11 +1,19 @@
 server {
     listen 80;
     server_name ci.f.novalon.cn;
-    return 301 https://$host$request_uri;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
 }
 
 server {
-    listen 443 ssl http2;
+    listen 443 ssl;
+    http2 on;
     server_name ci.f.novalon.cn;
 
     ssl_certificate /etc/nginx/ssl/ci.f.novalon.cn/fullchain.pem;
@@ -16,6 +24,10 @@ server {
     ssl_session_cache shared:SSL:10m;
     ssl_session_timeout 1d;
 
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;

conf.d/git.f.novalon.cn.conf

@@ -12,7 +12,8 @@ server {
 }
 
 server {
-    listen 443 ssl http2;
+    listen 443 ssl;
+    http2 on;
     server_name git.f.novalon.cn;
 
     ssl_certificate /etc/nginx/ssl/git.f.novalon.cn/fullchain.pem;
@@ -27,6 +28,7 @@ server {
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
     location / {
         limit_req zone=general burst=20 nodelay;