docs(runbook): containers via host proxy relay (socat on docker0)

Co-Authored-By: Claude Fable 5.1 <[email protected]>

docs/runbook/deploy.md

@@ -212,3 +212,25 @@ docker compose ps && docker compose logs --tail=50 app
 | 清理 | `compose down -v`、删除测试镜像与临时目录 |
 
 `UMT_FS_TEST_HANG_AFTER_BYTES` 只用于这类验收(让数据类操作的 worker 读到 n 字节后卡死 JS 线程并屏蔽 SIGTERM),必须同时设置 `UMT_FS_TEST_HOOKS=1` 才生效;单独设置不生效,但 `preflight` 会打 warn。生产不要设置。
+
+## 容器经宿主代理访问境外站点(可选)
+
+宿主上的代理(如 mihomo)常只监听 `127.0.0.1`,容器从网桥够不到。改动最小的做法:加一个只绑在 docker 网桥地址上的中继,再放行 docker 网段到该端口;代理本身配置不动。写在本机 `docker-compose.override.yml`(不进 git):
+
+```yaml
+services:
+  proxy-relay:
+    image: alpine/socat:1.8.0.0
+    network_mode: host
+    restart: unless-stopped
+    command: ["TCP-LISTEN:7891,bind=172.17.0.1,fork,reuseaddr", "TCP:127.0.0.1:7890"]
+  app:
+    environment:
+      HTTP_PROXY: http://172.17.0.1:7891
+      HTTPS_PROXY: http://172.17.0.1:7891
+      NO_PROXY: localhost,127.0.0.1,postgres,camofox,proxy-relay,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+  camofox:
+    environment: { HTTP_PROXY: http://172.17.0.1:7891, HTTPS_PROXY: http://172.17.0.1:7891, NO_PROXY: localhost,127.0.0.1,app,10.0.0.0/8,172.16.0.0/12 }
+```
+
+防火墙只放行 docker 网段:`ufw allow from 172.16.0.0/12 to 172.17.0.1 port 7891 proto tcp`。Deno 的 fetch 会读 `HTTP(S)_PROXY`/`NO_PROXY`;TMDB、境外 Pi 上游、camofox 访问境外站都经此代理,站内(postgres/camofox)不走代理。