feat: init Astro blog with wikilinks, KaTeX and local search

- Astro 5 static blog, zero runtime JS
- Obsidian wikilink remark plugin (slug matches Astro content collection)
- KaTeX math rendering, local search, TOC, archives, tags
- 5 posts on math/physics/ML topics
- deploy scripts for nginx + certbot + rsync

deploy/nginx.conf

@@ -0,0 +1,68 @@
+# Yukun's Blog · nginx 站点配置
+# 由 deploy/deploy.sh setup-nginx 自动上传到 sites-available(Debian) 或 conf.d(CentOS)，
+# 共享服务配置在 /etc/nginx/snippets/yukun.conf（由 nginx-serve.conf 上传）。
+#
+# 站点根目录：/var/www/yukun（deploy.sh 会 rsync 到这里）
+#
+# 首次部署：只用 80 段（HTTP 直接服务站点），nginx -t 可直接通过。
+# 申请证书后：./deploy/deploy.sh certbot 会自动 ① 启用 443 段 ② 把 80 段切为跳转。
+
+# ============================================================
+# 80 端口：HTTP
+#   · 首次（无证书）：include 片段，直接服务站点
+#   · 启用 HTTPS 后：改为 return 301 跳转到 443
+# ============================================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name sausagetoast.cloud www.sausagetoast.cloud;
+
+    # Let's Encrypt 证书验证（certbot webroot 用，无论是否启用 HTTPS 都需保留）
+    location /.well-known/acme-challenge/ {
+        root /var/www/html;
+    }
+
+    # @@HTTPS-REDIRECT-START@@
+    # 启用 HTTPS 后，certbot 会取消下面这行注释，把 80 段变成跳转：
+    # location / { return 301 https://$host$request_uri; }
+    # @@HTTPS-REDIRECT-END@@
+
+    # @@HTTP-SERVE-START@@
+    # 启用 HTTPS 后，certbot 会把这行注释掉（跳转段接管）：
+    include /etc/nginx/snippets/yukun.conf;
+    # @@HTTP-SERVE-END@@
+
+    access_log /var/log/nginx/yukun.access.log;
+    error_log  /var/log/nginx/yukun.error.log;
+}
+
+# ============================================================
+# 443 端口：HTTPS
+# 证书由 deploy/deploy.sh certbot 签发到 /etc/letsencrypt/live/sausagetoast.cloud/
+# 首次部署此段被注释（无证书时 nginx -t 才能过）；certbot 会自动取消注释。
+# @@HTTPS-START@@
+# server {
+#     listen 443 ssl http2;
+#     listen [::]:443 ssl http2;
+#     server_name sausagetoast.cloud www.sausagetoast.cloud;
+#
+#     ssl_certificate     /etc/letsencrypt/live/sausagetoast.cloud/fullchain.pem;
+#     ssl_certificate_key /etc/letsencrypt/live/sausagetoast.cloud/privkey.pem;
+#     ssl_protocols TLSv1.2 TLSv1.3;
+#     ssl_ciphers HIGH:!aNULL:!MD5;
+#     ssl_prefer_server_ciphers on;
+#     ssl_session_cache shared:SSL:10m;
+#     ssl_session_timeout 1d;
+#
+#     # www 跳主域名
+#     if ($host = www.sausagetoast.cloud) {
+#         return 301 https://sausagetoast.cloud$request_uri;
+#     }
+#
+#     include /etc/nginx/snippets/yukun.conf;
+#     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+#
+#     access_log /var/log/nginx/yukun.access.log;
+#     error_log  /var/log/nginx/yukun.error.log;
+# }
+# @@HTTPS-END@@