fix(nginx): 验证文件改用 root+try_files，443 层挂载 verify-root 直连避免 403

Made-with: Cursor

nginx/web.conf

@@ -4,8 +4,11 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    location ~ ^/([A-Za-z0-9._-]+\.(txt|html|xml))$ {
-        alias /verify-root/$1;
+    location ~ ^/[A-Za-z0-9._-]+\.(txt|html|xml)$ {
+        root /verify-root;
+        try_files $uri =404;
+        default_type text/plain;
+        add_header Cache-Control "no-store";
     }
 
     location ^~ /assets/ {

nginx/yuheng.docker.conf.tpl

@@ -17,6 +17,14 @@ server {
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
 
+    # 验证文件在 443 上直接读挂载目录，不经 yh_web 反代（避免正则 alias 403、与内网路径不一致）
+    location ~ ^/[A-Za-z0-9._-]+\.(txt|html|xml)$ {
+        root /verify-root;
+        try_files $uri =404;
+        default_type text/plain;
+        add_header Cache-Control "no-store";
+    }
+
     location / {
         set $upstream_web web;
         proxy_pass http://$upstream_web:80;