perf(ci): CI cache 全面優化 — pnpm/Playwright/apt-get 持久化加速

優化項目:
  1. pnpm store 持久化到 /opt/pnpm-store
     - pnpm-lock.yaml hash guard，未變則 --prefer-offline（接近 0 下載）
     - 預估節省: 2-4 min/run

  2. Playwright Chromium 持久化到 /opt/playwright-browsers
     - @playwright/test 版本 hash guard，版本未變跳過 --with-deps 安裝
     - 預估節省: 1-3 min/run

  3. apt-get python3.11 分離出 venv hash-guard
     - command -v python3.11 check，runner 已有就跳過 apt-get update+install
     - 預估節省: 20-40 sec/run（deps 變更時）

  4. 移除 Setup Python Tools step（pip install requests）
     - 改為在 Alert Chain / Monitoring 步驟直接 source /opt/api-venv
     - api-venv 已包含 requests，無需額外安裝

總計預估節省: 3-7 min/run

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/cd.yaml

@@ -77,11 +77,17 @@ jobs:
           HASH_FILE=/opt/api-venv/.deps_hash
           CURRENT_HASH=$(md5sum apps/api/pyproject.toml | awk '{print $1}')
 
+          # python3.11 是 runner 層級持久安裝，只在首次或版本消失時才 apt-get
+          # 2026-04-05 Claude Code: 分離 apt-get 與 venv hash-guard，避免每次 deps 變更都重跑 apt
+          if ! command -v python3.11 &>/dev/null; then
+            echo "📦 安裝 python3.11..."
+            apt-get update -q && apt-get install -y -q python3.11-venv python3.11
+          else
+            echo "⚡ python3.11 已安裝，跳過 apt-get"
+          fi
+
           if [ ! -d "$VENV" ] || [ "$(cat $HASH_FILE 2>/dev/null)" != "$CURRENT_HASH" ]; then
             echo "📦 deps 已變更，重建 venv..."
-            # pyproject.toml 要求 Python>=3.11，catthehacker/ubuntu:act-22.04 預設 python3=3.10
-            # 2026-04-05 Claude Code: 明確安裝 python3.11-venv 並用 python3.11 建立 venv
-            apt-get update -q && apt-get install -y -q python3.11-venv python3.11
             rm -rf "$VENV"
             python3.11 -m venv $VENV
             source $VENV/bin/activate
@@ -319,13 +325,9 @@ jobs:
           fi
           DEPLOY
 
-      # I2: 共用 pip 安裝（requests 只裝一次）
-      # 2026-04-05 Claude Code (首席架構師 Review I2): 消除重複 pip install
-      - name: Setup Python Tools
-        run: pip install requests --quiet
-
       # Phase O-4.5 2026-04-02: Alert Chain Smoke Test (Wave A.6 + B.2 ADR-037)
       # 驗證告警鏈路 E2E: API Health + Webhook + OTEL + Event Exporter
+      # 2026-04-05 Claude Code cache優化: 使用 /opt/api-venv (已有 requests)，移除 Setup Python Tools step
       - name: Alert Chain Smoke Test
         id: alert_chain_smoke
         continue-on-error: true
@@ -333,6 +335,7 @@ jobs:
           # 2026-04-05 Claude Code: 使用真實 API 地址（192.168.0.121:32334 NodePort）
           # CI job container 的 localhost 不等於 K3s 節點，必須用內網 IP
           # 首席架構師 Review C2: 修正永遠 pass — || true 移除，結果正確寫入 GITHUB_OUTPUT
+          source /opt/api-venv/bin/activate
           python3 scripts/alert_chain_smoke_test.py \
             --api-url http://192.168.0.121:32334 \
             --json | tee /tmp/alert_chain_result.json \
@@ -345,6 +348,7 @@ jobs:
         id: monitoring_coverage
         continue-on-error: true
         run: |
+          source /opt/api-venv/bin/activate
           python3 scripts/generate_monitoring.py --check && echo "coverage_status=pass" >> $GITHUB_OUTPUT || echo "coverage_status=fail" >> $GITHUB_OUTPUT
 
       # [首席架構師] 新增 Playwright E2E Smoke Test 步驟 v1.0.0 2026-04-01 (台北時間)
@@ -353,14 +357,37 @@ jobs:
         id: smoke
         continue-on-error: true
         run: |
-          # 首席架構師 Review I4 + 2026-04-05 Claude Code:
+          # 首席架構師 Review I4 + 2026-04-05 Claude Code cache優化:
           # playwright.config.ts import @playwright/test — 必須先安裝 pnpm node_modules
+          # pnpm store 持久化到 /opt/pnpm-store，pnpm-lock.yaml hash 未變則 --prefer-offline
+          PNPM_STORE=/opt/pnpm-store
+          PNPM_HASH_FILE=/opt/pnpm-store/.lock_hash
+          CURRENT_PNPM_HASH=$(md5sum pnpm-lock.yaml | awk '{print $1}')
+
           corepack enable 2>/dev/null || npm install -g pnpm@9 -q
-          pnpm install --frozen-lockfile 2>&1 | tail -5
+          pnpm config set store-dir $PNPM_STORE
+
+          if [ "$(cat $PNPM_HASH_FILE 2>/dev/null)" != "$CURRENT_PNPM_HASH" ]; then
+            echo "📦 pnpm lock 已變更，重裝 node_modules..."
+            pnpm install --frozen-lockfile 2>&1 | tail -5
+            echo "$CURRENT_PNPM_HASH" > $PNPM_HASH_FILE
+          else
+            echo "⚡ 使用快取 pnpm store (lock 未變更)，prefer-offline..."
+            pnpm install --frozen-lockfile --prefer-offline 2>&1 | tail -5
+          fi
 
           cd apps/web
-          # 安裝 Playwright Chromium（CI 環境，含系統依賴）
-          npx playwright install chromium --with-deps 2>&1 | tail -5
+          # Playwright Chromium 持久化到 /opt/playwright-browsers，版本 hash guard
+          export PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
+          PLAYWRIGHT_VER=$(node -e "console.log(require('../package.json').devDependencies['@playwright/test'] || '')" 2>/dev/null || echo "unknown")
+          PLAYWRIGHT_HASH_FILE=/opt/playwright-browsers/.version_hash
+          if [ "$(cat $PLAYWRIGHT_HASH_FILE 2>/dev/null)" != "$PLAYWRIGHT_VER" ]; then
+            echo "📦 Playwright 版本變更 ($PLAYWRIGHT_VER)，重裝 Chromium..."
+            npx playwright install chromium --with-deps 2>&1 | tail -5
+            echo "$PLAYWRIGHT_VER" > $PLAYWRIGHT_HASH_FILE
+          else
+            echo "⚡ 使用快取 Playwright Chromium ($PLAYWRIGHT_VER)"
+          fi
           # 對已部署的生產環境跑 smoke test
           npx playwright test tests/e2e/smoke.spec.ts --reporter=line \
             && echo "smoke_status=pass" >> $GITHUB_OUTPUT \