qa: validate server queries and prepare offline backend web update

deploy/query-summary/Update-Nas.ps1

@@ -0,0 +1,30 @@
+param(
+    [Parameter(Mandatory=$true)][string]$Package,
+    [string]$SshHost = 'fn',
+    [switch]$Deploy
+)
+$ErrorActionPreference = 'Stop'
+$release = (Resolve-Path -LiteralPath $Package).Path
+$manifest = Join-Path $release 'manifest.sha256'
+foreach ($line in Get-Content -LiteralPath $manifest -Encoding utf8) {
+    if ($line -notmatch '^([a-f0-9]{64})  ([A-Za-z0-9._-]+)$') { throw '发布清单格式不符' }
+    if ((Get-FileHash -LiteralPath (Join-Path $release $Matches[2]) -Algorithm SHA256).Hash.ToLowerInvariant() -ne $Matches[1]) { throw '本地发布文件校验失败' }
+}
+if (-not $Deploy) {
+    Write-Output '本地发布包校验通过。仅更新backend/web，worker、端口、密码和数据挂载沿用。'
+    Write-Output '得到明确部署确认后，在交互PowerShell使用同一命令加 -Deploy；sudo密码只在终端输入。'
+    return
+}
+if ($SshHost -notmatch '^[A-Za-z0-9._-]+$') { throw 'SSH别名无效' }
+$remote = '/tmp/mi-fitness-summary8-' + (Get-Date -Format 'yyyyMMdd-HHmmss')
+& ssh $SshHost "umask 077; mkdir '$remote'"
+if ($LASTEXITCODE -ne 0) { throw '创建远程发布目录失败' }
+foreach ($line in Get-Content -LiteralPath $manifest -Encoding utf8) {
+    $name = ($line -split '  ',2)[1]
+    & scp (Join-Path $release $name) "${SshHost}:$remote/$name"
+    if ($LASTEXITCODE -ne 0) { throw '发布文件传输失败' }
+}
+& scp $manifest "${SshHost}:$remote/manifest.sha256"
+if ($LASTEXITCODE -ne 0) { throw '发布清单传输失败' }
+& ssh -t $SshHost "sudo sh '$remote/update-health.sh'"
+if ($LASTEXITCODE -ne 0) { throw '部署未通过，请保留终端输出和回退备份。' }