fix(ops): seo-unblock v2——备份出加载路径+主机判定精确 token

v1 实弹暴露两缺陷：①.bak-seo 备份留在 sites-enabled/ 内被 nginx
glob 加载→duplicate default server 全链崩；②grep -w 词边界点号
之误，git.wait4x.online 也被当博客主站注入 admin location。
v2：备份入 /tmp 专属目录+回滚后清理（含 v1 遗留）+server_name
精确 token 判定。

验证: bash -n 语法过；dry-run 计划段与判定正则复核

Spec: none (脚本热修：v1 事故根因双修)

Co-authored-by: GLM-5.3

scripts/ops/seo-unblock.sh

@@ -7,6 +7,7 @@
 set -euo pipefail
 SNIPPET=/etc/nginx/snippets/esa-origin-ssl.conf
 BAK="${SNIPPET}.bak-$(date +%s)"
+BAKDIR=/tmp/seo-unblock-bak-$(date +%s)
 SITES=/etc/nginx/sites-enabled
 
 echo "==== ① 现状 ===="
@@ -19,11 +20,11 @@ for f in "$SITES"/*; do
   names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true)
   [ -z "$names" ] && continue
   # 内部服务判定：server_name 含内部子域且不含主站裸域
-  if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qw "wait4x.online"; then
+  if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
     sudo grep -q "X-Robots-Tag" "$f" || echo "  [补回] $f：server 块加 add_header X-Robots-Tag noindex always;"
   fi
   # 博客主站判定：server_name 恰含裸域
-  if echo "$names" | grep -qw "wait4x.online"; then
+  if echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
     sudo grep -q "location /admin/" "$f" || echo "  [新增] $f：location /admin/ { noindex }"
   fi
 done
@@ -33,23 +34,24 @@ read -rp ">> 按计划执行？(y/N) " ok; [ "$ok" = "y" ] || { echo "已取消
 
 echo
 echo "==== ③ 执行 ===="
+sudo mkdir -p "$BAKDIR"
 sudo cp "$SNIPPET" "$BAK" && echo "  备份：$BAK"
 sudo sed -i '/X-Robots-Tag noindex/d' "$SNIPPET" && echo "  snippet 已剥 noindex"
 
 for f in "$SITES"/*; do
   names=$(sudo grep -h "server_name" "$f" 2>/dev/null || true)
   [ -z "$names" ] && continue
-  if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qw "wait4x.online"; then
+  if echo "$names" | grep -qE "(git|api|oj|token|fc|latex|cpa)\.wait4x\.online" && ! echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
     if ! sudo grep -q "X-Robots-Tag" "$f"; then
-      sudo cp "$f" "$f.bak-seo"
+      sudo cp "$f" "$BAKDIR/$(basename "$f")"
       # 在首个 server_name 行后插入（server 块内、顶层指令位置合法）
       sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n    add_header X-Robots-Tag noindex always;/" "$f"
       echo "  补回：$f"
     fi
   fi
-  if echo "$names" | grep -qw "wait4x.online"; then
+  if echo "$names" | grep -qE "server_name[^;]*(^|[[:space:]])(www\.)?wait4x\.online([[:space:]];|$)" || echo "$names" | grep -qx "server_name wait4x.online;"; then
     if ! sudo grep -q "location /admin/" "$f"; then
-      sudo cp "$f" "$f.bak-seo" 2>/dev/null || sudo cp "$f" "$f.bak-seo"
+      sudo cp "$f" "$BAKDIR/$(basename "$f")"
       sudo sed -i "0,/server_name/s/\(server_name.*\)/\1\n    location \/admin\/ { add_header X-Robots-Tag noindex always; }/" "$f"
       echo "  admin 局部：$f"
     fi
@@ -61,9 +63,11 @@ echo "==== ④ 语法检查+重载（失败自动回滚）===="
 if ! sudo nginx -t; then
   echo "!! nginx -t 失败，回滚全部改动"
   sudo cp "$BAK" "$SNIPPET"
-  for f in "$SITES"/*.bak-seo; do
-    [ -f "$f" ] && sudo cp "$f" "${f%.bak-seo}"
+  for f in "$BAKDIR"/*; do
+    [ -f "$f" ] && sudo cp "$f" "$SITES/$(basename "$f")"
   done
+  sudo rm -rf "$BAKDIR"
+  sudo rm -f "$SITES"/*.bak-seo   # v1 遗留备份也在加载路径上，一并清掉
   sudo nginx -t && sudo systemctl reload nginx
   echo "已回滚，请把以上报错发给 research 人工处理"; exit 1
 fi