feat(vnext): complete vNext.1 release gate — default chain admission, idempotent init, user key skeleton

- DEFAULT_CHAIN_ADMISSION.md: reviewed and approved, real artifact refs added
- DEFAULT_DATA_IDEMPOTENT_RELEASE_GATE.md: reviewed and approved
- scripts/setup_default_data.sh: idempotent init with --dry-run/--apply/artifact
- scripts/test/test_default_data.sh: 4 test cases all pass
- scripts/acceptance/verify_user_key_self_service.sh: Phase 0 skeleton
- .gitignore: add generated artifact directories

scripts/acceptance/verify_user_key_self_service.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# verify_user_key_self_service.sh — 用户 key 自助验收入口
+#
+# 本脚本为 Phase 0 skeleton。验收逻辑在 Phase 3（vNext.2）实现。
+# 当前仅验证环境就绪与目录规范。
+#
+# 使用方式：
+#   bash scripts/acceptance/verify_user_key_self_service.sh --help
+#   bash scripts/acceptance/verify_user_key_self_service.sh [--env-check]
+
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+TS="$(date +%Y%m%d_%H%M%S)"
+ARTIFACT_DIR="${ARTIFACT_DIR:-$ROOT_DIR/artifacts/user-key-self-service/${TS}}"
+
+CRM_BASE="${CRM_BASE:-https://sub.tksea.top/portal-admin-api}"
+
+# --- helpers ---
+die() { echo "FATAL: $*" >&2; exit 1; }
+info() { echo "INFO: $*"; }
+ok()   { echo "OK:   $*"; }
+
+cmd_help() {
+  cat <<HELP
+usage: $(basename "$0") [--help|--env-check]
+
+Phase 0 skeleton — user key self-service acceptance script.
+
+options:
+  --help       显示此帮助
+  --env-check  验证环境变量与基本可达性
+
+当前状态：
+  此脚本为 vNext.1 Phase 0 骨架。验收逻辑将在 vNext.2 (Phase 3) 实现。
+  vNext.1 目标用户 key 自助已明确推迟到 vNext.2。
+
+环境变量:
+  CRM_BASE     CRM API 基础 URL (default: https://sub.tksea.top/portal-admin-api)
+  CRM_ADMIN_TOKEN  Admin token（可选，env-check 用）
+
+验收范围 (vNext.2):
+  - 用户 key 自助申请
+  - key 首次回显与仅首次显示明文
+  - key 状态展示（active/paused/exhausted）
+  - 用户首次 POST /v1/chat/completions = 200 闭环
+
+输出:
+  artifacts/user-key-self-service/<timestamp>/
+HELP
+  exit 0
+}
+
+cmd_env_check() {
+  info "env-check mode"
+  mkdir -p "$ARTIFACT_DIR"
+
+  if [[ -z "${CRM_BASE}" ]]; then
+    warn "CRM_BASE is empty"
+  else
+    ok "CRM_BASE=${CRM_BASE}"
+  fi
+
+  if [[ -n "${CRM_ADMIN_TOKEN:-}" ]]; then
+    ok "CRM_ADMIN_TOKEN is set"
+    local whoami
+    whoami="$(curl -sS --noproxy '*' -H "Authorization: Bearer $CRM_ADMIN_TOKEN" "${CRM_BASE}/api/admin/session" 2>/dev/null)" || true
+    if echo "${whoami}" | python3 -c "import sys,json; d=json.load(sys.stdin); d.get('authenticated',False) or d.get('username','')" 2>/dev/null; then
+      ok "Admin session: valid"
+    else
+      warn "Admin session: invalid. Phase 3 will establish login flow."
+    fi
+  else
+    info "CRM_ADMIN_TOKEN not set — skipped (Phase 3 will implement login)"
+  fi
+
+  # Check portal-admin-api reachability
+  local health
+  health="$(curl -sS --noproxy '*' "${CRM_BASE}/healthz" 2>/dev/null)" || true
+  if [[ "${health}" == "ok" ]]; then
+    ok "CRM health: OK"
+  else
+    warn "CRM health: ${health:-unreachable}"
+  fi
+
+  # Write env-check summary
+  local summary_file="$ARTIFACT_DIR/env-check-summary.json"
+  python3 -c "
+import json, sys, datetime, os
+d = {
+  'timestamp': datetime.datetime.now().isoformat(),
+  'mode': 'env_check',
+  'crm_base': os.environ.get('CRM_BASE', ''),
+  'crm_reachable': '${health:-}' == 'ok',
+  'admin_token_set': bool(os.environ.get('CRM_ADMIN_TOKEN', '')),
+  'phase': 'skeleton',
+  'note': 'Full verification deferred to vNext.2 (Phase 3)'
+}
+with open(sys.argv[1], 'w') as f:
+    json.dump(d, f, ensure_ascii=False, indent=2)
+" "$summary_file"
+  ok "env-check summary: $summary_file"
+}
+
+# --- main ---
+case "${1:---help}" in
+  --help|-h) cmd_help ;;
+  --env-check) cmd_env_check ;;
+  *) cmd_help ;;
+esac