fix(ops): /admin/ 404 修复脚本——location 块补 root

病根：博客 vhost 的 root 写在 location / 内（launch.sh 静态切换设
计），nginx 的 location 不向上继承 root，故后来加的 location
/admin/ 块落到默认根目录 → 404（用户打不开后台的直接原因）。
脚本幂等重写 admin 块（root+index+noindex 局部），-t 门禁+回滚+
双口径终验。

验证: bash -n 语法过；本地 dist/admin 三件齐全（config/index/js）

Spec: none (运维修复脚本)

Co-authored-by: GLM-5.3

scripts/ops/fix-admin-location.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# 修复 /admin/ 404：location /admin/ 缺 root（本 vhost 的 root 写在 location / 内，
+# 不会向上继承到其它 location 块——nginx 规则，故 admin 块必须自带 root）
+# 用法：sudo bash scripts/ops/fix-admin-location.sh   （幂等，含 -t 门禁与回滚）
+set -euo pipefail
+DEFAULT=/etc/nginx/sites-enabled/default
+STAGING=/home/wait4x/docker_apps/blog/www-staging
+BAK=/tmp/fix-admin-bak-$(date +%s)
+
+echo "==== ① 现状 ===="
+grep -n -A3 "location /admin/" "$DEFAULT" || echo "（未找到 admin 块）"
+
+echo
+echo "==== ② 变更计划 ===="
+echo "  把 location /admin/ 块重写为："
+echo "    location /admin/ { root $STAGING; index index.html; add_header X-Robots-Tag noindex always; }"
+
+echo
+read -rp ">> 执行？(y/N) " ok; [ "$ok" = "y" ] || { echo "已取消"; exit 0; }
+
+cp "$DEFAULT" "$BAK"
+python3 - "$DEFAULT" "$STAGING" <<'PY'
+import re, sys
+path, staging = sys.argv[1], sys.argv[2]
+src = open(path, encoding='utf-8').read()
+pat = re.compile(r'[ \t]*location /admin/ \{[^}]*\}\n')
+if not pat.search(src):
+    print('未找到 admin 块，追加到博客 server_name 之后'); 
+    src = src.replace('server_name wait4x.online;',
+        f'server_name wait4x.online;\n    location /admin/ {{ root {staging}; index index.html; add_header X-Robots-Tag noindex always; }}', 1)
+else:
+    src = pat.sub(f'    location /admin/ {{ root {staging}; index index.html; add_header X-Robots-Tag noindex always; }}\n', src, count=1)
+open(path, 'w', encoding='utf-8').write(src)
+print('admin 块已重写（含 root）')
+PY
+
+echo
+echo "==== ③ 门禁 ===="
+if ! nginx -t; then
+  echo "!! 语法失败，回滚"; cp "$BAK" "$DEFAULT"; nginx -t && systemctl reload nginx; exit 1
+fi
+systemctl reload nginx && echo "  nginx 已重载"
+
+echo
+echo "==== ④ 终验（源站直测 + 公网）===="
+S1=$(curl -skI --noproxy '*' --resolve wait4x.online:443:127.0.0.1 https://wait4x.online/admin/ -m 6 -o /dev/null -w '%{http_code}' || echo err)
+echo "  源站(443 直连) /admin/ → $S1"
+S2=$(curl -s --compressed --noproxy '*' -m 8 -o /dev/null -w '%{http_code}' https://wait4x.online/admin/ || echo err)
+echo "  公网 /admin/ → $S2（ESA 缓存最多 1h；未变可强刷 Ctrl+Shift+R）"
+curl -s --compressed --noproxy '*' -m 8 https://wait4x.online/admin/config.yml | head -2
+echo "  上面两行是 config.yml 开头即成功（backend/collections 定义）"
+rm -f "$BAK"