feat(launch): 热力图与 webhook 发布闭环（T2/T3）

- T2 (op-artalk 车道)：gitea heatmap 构建期拉取+fallback+空态三保险，
  53×7 灰阶格复用 tokens（亮暗自动），日界锚定 Asia/Shanghai，零 JS，
  zh/en 首页挂载；fallback 经死端点实测不破构建
- T3：webhook_receiver.py（HMAC 强制+main-only+构建锁）以 systemd
  --user 常驻 13021；gitea hook 注册（events=push, branch=main）
- 三个深坑：gitea 容器回宿主须走桥网关 IP 而非 127.0.0.1；gitea 28
  egress 拦私网须 ALLOWED_HOST_LIST（ALLOWLIST 是废弃名）；systemd
  用户服务缺用户 PATH 致 build 静默失败（stamp 不更新即症状）

验证: 测试投递 202→构建→staging 戳更新（09:48:37 实测）；
      dist 热力图 376 格真数据（9 次贡献）zh/en 双页

Spec: 2026-10-25_add-blog-launch
Co-authored-by: GLM-5.3

src/pages/index.astro

@@ -5,6 +5,8 @@ import BaseLayout from '../layouts/BaseLayout.astro';
 import IdCard from '../components/IdCard.astro';
 import PostList from '../components/PostList.astro';
 import ProjectWall from '../components/geek/ProjectWall.astro';
+import Heatmap from '../components/geek/Heatmap.astro';
+import { t } from '../i18n/ui';
 
 const posts = (await getCollection('posts', ({ data }) => !data.draft)).sort(
   (a, b) => b.data.pubDate.getTime() - a.data.pubDate.getTime(),
@@ -84,6 +86,15 @@ const photos = (await getCollection('photos')).slice(0, 4);
     </div>
   </section>
 
+  <Heatmap
+    labels={{
+      title: t('heatmap_title', 'zh'),
+      summary: t('heatmap_summary', 'zh'),
+      less: t('heatmap_less', 'zh'),
+      more: t('heatmap_more', 'zh'),
+      note: t('heatmap_note', 'zh'),
+    }}
+  />
   <ProjectWall />
 </BaseLayout>