feat: Z34b restore-by-host + harden web nginx DNS race

Add HMAC restore-by-host for phone-less rebind; resolve gateway at request time and recreate web after stack up.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/lib-aijz-deploy.sh

@@ -344,6 +344,9 @@ stack_up() {
       compose_cmd up -d --build
     fi
   fi
+  # Podman DNS 竞态：web 可能因启动时解析不到 gateway 而退出，gateway 就绪后再拉起一次
+  sleep 2
+  compose_cmd up -d --force-recreate web >/dev/null 2>&1 || compose_cmd up -d web || true
   install_host_nginx_site_conf || true
 }
 
@@ -366,6 +369,10 @@ healthcheck() {
       ok=1
       break
     fi
+    # 中途补拉 web（常见：nginx 启动时 DNS 未就绪已退出）
+    if [ $((i % 10)) -eq 0 ]; then
+      compose_cmd up -d web >/dev/null 2>&1 || true
+    fi
     sleep 2
   done
   if [ "$ok" -eq 1 ]; then