修复更新后服务无法访问：强制 systemd 配置与健康检查。

- update.sh 必须 root 运行，自动注册并重启 grade-archive

- 新增 deploy/repair.sh 一键修复连接被拒绝

deploy/update.sh

@@ -5,18 +5,16 @@ INSTALL_DIR="${INSTALL_DIR:-/opt/secondary-school-grade-archive}"
 BRANCH="${BRANCH:-main}"
 PIP_MIRROR="${PIP_MIRROR:-https://pypi.tuna.tsinghua.edu.cn/simple}"
 
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-NC='\033[0m'
-log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
-
+# shellcheck source=common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
 # shellcheck source=proxy.sh
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/proxy.sh"
 
+require_root "deploy/update.sh"
+
 cd "${INSTALL_DIR}" || exit 1
 find "${INSTALL_DIR}" -name "*.sh" -exec sed -i 's/\r$//' {} +
-chmod +x deploy/start.sh
+chmod +x deploy/start.sh deploy/install-ocr-deps.sh deploy/repair.sh
 
 setup_deploy_proxy
 
@@ -27,7 +25,6 @@ git pull origin "${BRANCH}"
 
 if [[ ! -f "${INSTALL_DIR}/frontend/dist/index.html" ]]; then
   log_error "未找到 frontend/dist/index.html"
-  log_error "请先在开发机构建前端并推送到仓库: cd frontend && npm run build && git add frontend/dist && git push"
   exit 1
 fi
 
@@ -36,17 +33,16 @@ cd backend
 source venv/bin/activate
 pip install -r requirements.txt --progress-bar on -i "${PIP_MIRROR}"
 deactivate
+cd "${INSTALL_DIR}"
 
-if command -v pm2 &>/dev/null; then
-  pm2 delete grade-api grade-web 2>/dev/null || true
+stop_legacy_pm2
+install_ocr_deps_safe
+setup_systemd_service
+restart_grade_service
+
+if ! wait_healthy; then
+  log_error "更新后服务异常，可尝试: sudo bash ${INSTALL_DIR}/deploy/repair.sh"
+  exit 1
 fi
 
-if [[ "${EUID:-$(id -u)}" -eq 0 ]]; then
-  log_info "检查 OCR 系统依赖（libGL）…"
-  bash "${INSTALL_DIR}/deploy/install-ocr-deps.sh"
-fi
-
-log_info "重启 systemd 服务…"
-systemctl restart grade-archive
-
-log_info "更新完成 — 访问端口见 .env 中 WEB_PORT（默认 23566）"
+log_info "更新完成"