Add initial setup for local HTTPS debugging and Nginx configuration

- Introduce `setup-certs.sh` script for generating trusted local TLS certificates using mkcert.
- Add Nginx configuration files for local and Docker environments to handle HTTPS requests and proxy to backend services.
- Update `docker-compose.yaml` to include Nginx service for unified TLS entry and adjust frontend service ports for local development.
- Create `AGENTS.md` and `README.md` files to document the local HTTPS setup process and usage instructions.
- Modify backend startup commands in `README.md` for consistency with new requirements.
- Add `.gitignore` to exclude generated certificates from version control.

docker-compose.yaml

@@ -2,7 +2,12 @@
 #
 # 核心服务(默认起):postgres + api + ui
 #   docker compose up -d postgres api      # 后端 + 库
-#   docker compose up -d                   # 再带上前端 ui
+#   docker compose up -d                   # 再带上前端 ui → http://localhost:3030
+#
+# 语音对话调试(参考 dograh quick start 的直连方案):
+#   docker compose up -d && make db-seed   # 首次需灌种子(凭证+助手)
+#   浏览器开 http://localhost:3030 → 助手 → 语音预览
+#   (localhost 是 secure context,麦克风可用;WebRTC 媒体直连 api,WS 信令走 :8000)
 #
 # 可选服务(用 profile 推迟到需要时):
 #   docker compose --profile data up -d    # + redis / rustfs(后台任务、S3 录音存储)
@@ -42,7 +47,8 @@ services:
     environment:
       # 容器内连库:用服务名 postgres,覆盖 .env 里的 localhost
       DATABASE_URL: "postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/postgres"
-      CORS_ORIGINS: "http://localhost:3000,http://127.0.0.1:3000"
+      # 3030 = docker ui 宿主端口;3000 = 宿主机裸跑 npm run dev 时的端口
+      CORS_ORIGINS: "http://localhost:3030,http://127.0.0.1:3030,http://localhost:3000,http://127.0.0.1:3000"
     ports:
       - "8000:8000"
     depends_on:
@@ -67,7 +73,8 @@ services:
       - ./frontend:/app
       - /app/node_modules
     ports:
-      - "3000:3000"
+      # 宿主机用 3030 访问(容器内 next dev 仍监听 3000),避开本地裸跑前端的 3000
+      - "3030:3000"
     depends_on:
       - api
     networks: [app-network]
@@ -117,6 +124,25 @@ services:
       - --min-port=49152
       - --max-port=49200
 
+  # ---- 可选(profile: tls):nginx 反代统一 TLS,局域网 https 调试语音预览 ----
+  # 起前先生成证书:./deploy/setup-certs.sh(证书落在 deploy/certs/)
+  #   docker compose --profile tls up -d
+  #   浏览器 → https://localhost 或 https://<本机IP>
+  nginx:
+    image: nginx:alpine
+    profiles: ["tls"]
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      # 整份配置当作 nginx.conf 加载(容器内 proxy_pass 用服务名 api/ui)
+      - ./deploy/nginx/ai-video.docker.conf:/etc/nginx/nginx.conf:ro
+      - ./deploy/certs:/etc/nginx/certs:ro
+    depends_on:
+      - api
+      - ui
+    networks: [app-network]
+
 volumes:
   postgres_data:
   redis_data: