refactor: migrate to New API with SQLite

.env.example

@@ -1,49 +1,10 @@
-# 首次执行 ./manage.sh init 会自动替换下面两个占位值。
-COMPOSE_PROJECT_NAME=proxy-llm-api
-# full: Hub + CLIProxyAPI + 所需存储；cliproxy: 仅 CLIProxyAPI。
-DEPLOY_MODE=full
-ADMIN_TOKEN=change-me
-DB_USER=postgres
-DB_PASSWORD=your-secure-password_change-me
-DB_NAME=claude_code_hub
-
-# Hub 入口。只允许本机访问可写成 127.0.0.1:23000。
-APP_PORT=23000
-APP_URL=
-# 远程纯 HTTP 调试时可设 false；正式公网部署应保留 true 并使用 HTTPS。
-ENABLE_SECURE_COOKIES=true
-
-# 留空时自动启动内置 PostgreSQL 与 Dragonfly；两项可独立外接。
-EXTERNAL_POSTGRES_DSN=
-EXTERNAL_REDIS_URL=
-
-# 1 GiB 机器建议改为 384mb 或 512mb。
-DRAGONFLY_IMAGE=docker.dragonflydb.io/dragonflydb/dragonfly:v1.40.0
-DRAGONFLY_MAXMEMORY=1gb
-DRAGONFLY_THREADS=2
-
-# 可选代理。分享链接含 # 时必须用单引号包住整个值。
-SINGBOX_NODE_URL=
-SINGBOX_CONFIG_PATH=
-SINGBOX_IMAGE=ghcr.io/sagernet/sing-box:v1.13.16
-
-# DEPLOY_MODE=cliproxy 时必填。在 Cloudflare 创建 remotely-managed Tunnel
-# 后，从官方 Docker 命令中复制 --token 后面的完整值。
-CF_TUNNEL_TOKEN=
-CLOUDFLARED_IMAGE=cloudflare/cloudflared:2026.7.3
-
-# CLIProxyAPI 默认只供本机与 Compose 内网访问。
-CLIPROXY_BIND_ADDRESS=127.0.0.1
-CLIPROXY_PORT=8317
-CLIPROXY_CALLBACK_BIND_ADDRESS=127.0.0.1
-
-# 默认直接使用 GitHub Actions 构建的 GHCR 镜像。
-CLI_PROXY_IMAGE=ghcr.io/pluxeljs/proxy-llm-api:latest
-
-# 以下仅用于可选的本地源码构建和持久化路径覆盖。
-CLIPROXY_REPOSITORY=https://github.com/router-for-me/CLIProxyAPI.git
-CLIPROXY_REF=main
-CLIPROXY_CONFIG_PATH=./cliproxyapi/config.yaml
-CLIPROXY_AUTH_PATH=./cliproxyapi/oa
-CLIPROXY_LOG_PATH=./cliproxyapi/logs
-CLIPROXY_PLUGIN_PATH=./cliproxyapi/plugins
+# Documentation only. `./manage.sh init` generates the actual private .env
+# under ~/.local/state/new-api-runtime, outside the checkout and Nix store.
+NEW_API_IMAGE=docker.io/calciumion/new-api:v0.13.2
+NEW_API_BIND_ADDRESS=127.0.0.1
+NEW_API_PORT=23000
+TZ=Asia/Taipei
+# NEW_API_DATA_DIR is generated as an absolute path to <state>/data.
+# NEW_API_SESSION_SECRET is generated once. Keep it with SQLite backups.
+# NEW_API_ENGINE and NEW_API_PROJECT are persisted by init.
+# First Docker use: NEW_API_ENGINE=docker ./manage.sh init

.github/workflows/check.yaml

@@ -0,0 +1,23 @@
+name: Check New API runtime
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  runtime:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Runtime and SQLite backup tests
+        run: python3 -m unittest discover -s tests -v
+      - name: Validate single-service Compose
+        env:
+          NEW_API_SESSION_SECRET: ci-config-validation-only
+          NEW_API_DATA_DIR: /tmp/new-api-ci-data
+        run: |
+          test "$(docker compose -f docker-compose.yaml config --services)" = new-api
+          bash -n manage.sh
+      - name: Docker lifecycle, file ownership and SQLite recovery
+        run: python3 tests/smoke_docker.py

.gitignore

@@ -1,45 +1,24 @@
-# Local environment and secrets
+# Private configuration and runtime data
 .env
 .env.*.local
+/data/
+/backups/
+*.db
+*.db-wal
+*.db-shm
 
-# Runtime configuration may contain API and management keys
-cliproxyapi/config.yaml
-cliproxyapi/docker-config.yaml
-
-# OAuth credentials, refresh tokens, logs, and installed plugins
-cliproxyapi/oa/*
-!cliproxyapi/oa/.gitkeep
-cliproxyapi/logs/*
-!cliproxyapi/logs/.gitkeep
-cliproxyapi/plugins/*
-!cliproxyapi/plugins/.gitkeep
-
-# Generated/custom sing-box configs contain node credentials.
-sing-box/*.json
-!sing-box/*.example.json
-
-# Legacy downloaded artifacts from the previous image-based deployment
+# Upgraded checkouts may still contain old private state; never commit it.
+/cliproxyapi/
+/sing-box/
+/deploy/
 /cli-proxy-api
-/cliproxyapi/cli-proxy-api
-/cliproxyapi/LICENSE
-/cliproxyapi/README.md
-/cliproxyapi/README_CN.md
-
-# Stateful services
-data/postgres/
-data/redis/
-data/dragonfly/
-data/sing-box/
-
-# Remote s-ui deployment secrets and state
-deploy/s-ui-server/.env
-deploy/s-ui-server/data/
-deploy/s-ui-server/backups/
 
-# Editor and OS files
+# Build and editor artifacts
+/result
+/result-*
+__pycache__/
+*.py[cod]
 .DS_Store
 .idea/
 .vscode/
 *.swp
-__pycache__/
-*.py[cod]