feat(launch): 热力图与 webhook 发布闭环（T2/T3）

- T2 (op-artalk 车道)：gitea heatmap 构建期拉取+fallback+空态三保险，
  53×7 灰阶格复用 tokens（亮暗自动），日界锚定 Asia/Shanghai，零 JS，
  zh/en 首页挂载；fallback 经死端点实测不破构建
- T3：webhook_receiver.py（HMAC 强制+main-only+构建锁）以 systemd
  --user 常驻 13021；gitea hook 注册（events=push, branch=main）
- 三个深坑：gitea 容器回宿主须走桥网关 IP 而非 127.0.0.1；gitea 28
  egress 拦私网须 ALLOWED_HOST_LIST（ALLOWLIST 是废弃名）；systemd
  用户服务缺用户 PATH 致 build 静默失败（stamp 不更新即症状）

验证: 测试投递 202→构建→staging 戳更新（09:48:37 实测）；
      dist 热力图 376 格真数据（9 次贡献）zh/en 双页

Spec: 2026-10-25_add-blog-launch
Co-authored-by: GLM-5.3

src/i18n/ui.ts

@@ -64,6 +64,14 @@ const dict = {
     zh: '页面由 Astro 静态生成，不含运行时框架 JS；内容住在自托管 gitea——本地编辑器与 gitea 网页写的是同一个 git 仓库，push 之后由 homelab 自动构建发布；评论走自托管 Artalk。页脚 built from 一行链到本次构建对应的 commit，构建过程透明可追溯。',
     en: 'Pages are statically generated by Astro with no runtime framework JS. Content lives on a self-hosted gitea — my local editor and the gitea web UI write to the same git repository, and each push is built and published automatically by the homelab. Comments run on self-hosted Artalk. The built-from line in the footer links to the commit behind this build, keeping the process transparent and traceable.',
   },
+
+  // ===== 热力图（Phase 4 T2 车道）：文案全部页面层注入，组件保持 locale 无关 =====
+  heatmap_title: { zh: '开源活动', en: 'Open Source Activity' },
+  // {n} 为总贡献次数占位符，调用点 .replace() 填值
+  heatmap_summary: { zh: '最近一年 {n} 次贡献', en: '{n} contributions in the last year' },
+  heatmap_less: { zh: '少', en: 'Less' },
+  heatmap_more: { zh: '多', en: 'More' },
+  heatmap_note: { zh: '数据来自 gitea · 构建期生成', en: 'via gitea · generated at build time' },
 } as const;
 
 export type UiKey = keyof typeof dict;