修复更新后服务无法访问：强制 systemd 配置与健康检查。

- update.sh 必须 root 运行，自动注册并重启 grade-archive

- 新增 deploy/repair.sh 一键修复连接被拒绝

deploy/repair.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+#
+# 服务无法访问（连接被拒绝）时一键修复
+# 用法: sudo bash deploy/repair.sh
+#
+set -euo pipefail
+
+INSTALL_DIR="${INSTALL_DIR:-/opt/secondary-school-grade-archive}"
+
+# shellcheck source=common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
+
+require_root "deploy/repair.sh"
+
+cd "${INSTALL_DIR}" || exit 1
+find "${INSTALL_DIR}" -name "*.sh" -exec sed -i 's/\r$//' {} +
+
+log_info "开始修复 grade-archive 服务…"
+
+stop_legacy_pm2
+install_ocr_deps_safe
+setup_systemd_service
+restart_grade_service
+
+if wait_healthy; then
+  ip=$(hostname -I 2>/dev/null | awk '{print $1}')
+  ip="${ip:-127.0.0.1}"
+  echo ""
+  echo "=========================================="
+  echo "  修复完成，请访问: http://${ip}:${WEB_PORT}"
+  echo "=========================================="
+else
+  show_service_status
+  exit 1
+fi