chore(release): v2.4.1

[xiaou61]

Summary

• Extract the duplicated frontend design system into code-nest-design-system and reuse it from both Vue applications.
• Replace static Redis/thread helpers with injected cache boundaries and Spring-managed or module-specific executors; optimize learning, community, moment, moyu, lottery, captcha, and related hot paths.
• Add focused regression coverage for learning cockpit, WebSocket tickets, Redis value storage, and moment services.
• Reorganize all 129 VitePress pages, add the responsive documentation theme, dynamic sync baseline, and navigation audit.
• Prepare and align the complete v2.4.1 release metadata.

Related Issues

• N/A

Change Type

• Feature
• Bug fix
• Refactor
• Performance
• Security
• Documentation
• Build / CI / dependency
• Database / migration
• Release

Scope

• Affected modules: xiaou-common, xiaou-application, xiaou-community, xiaou-moment, xiaou-moyu, xiaou-points, xiaou-user, xiaou-chat, dual frontends, shared design system, docs site
• Affected pages/routes: documentation navigation and theme; application routes are unchanged
• Affected APIs/prefixes: no public API contract changes
• Affected tables/fields: none
• Affected permissions/roles: none
• Affected configs/env vars: no new production configuration

Behavior Changes

• Both frontends now resolve shared UI code from the repository-local @code-nest/design-system package.
• Common cache and async behavior uses injected, bounded infrastructure instead of static global helpers.
• Documentation is organized by task and domain with automated drift checks.
• Database schema, external API contracts, authentication, and production environment variables are unchanged.

Verification

• Backend compile/test executed
• User frontend build/smoke test executed
• Admin frontend build/smoke test executed
• Database SQL reviewed or executed in test environment
• Permission/security path checked
• Error/empty/loading states checked
• Documentation updated
• Not applicable or explained below

Verification notes:

Executed:
- ./scripts/code-nest-eval.ps1 -Tier release
- ./scripts/code-nest-eval.ps1 -Tier hygiene
- VitePress Playwright QA at 1440px and 390px, light/dark, menu, search, long tables, keyboard focus

Passed:
- 29-module Maven package; xiaou-application-v2.4.1.jar generated
- Admin frontend build
- User frontend build
- Docs audit and production build (129 pages)
- Python and shell release-script syntax
- Whitespace, placeholder-only secret scan, and NUL-byte scan
- Browser console: 0 errors / 0 warnings

Not verified:
- Production smoke test
- GitHub-hosted CI jobs (pending on this PR)

Reason:
- Production verification is performed only after merge/tag by the existing deployment workflow.

Dependencies:
- No new database, environment, or external service dependency

Docs Sync Checklist

• New user page -> updated docs-site/reference/frontend-routes.md and related module docs
• New admin page -> updated route, permission, and admin docs
• New Controller or route prefix -> updated docs-site/reference/api-routes.md
• New table, field, index, or migration -> updated docs-site/reference/database-tables.md
• New WebSocket event -> updated docs-site/reference/websocket.md
• New error code or exception behavior -> updated docs-site/reference/response-errors.md
• New AI Prompt, RAG, Schema, or regression case -> updated AI docs
• New release or high-risk fix -> updated CHANGELOG.md and release notes
• Documentation not required; reason:

Items without code changes are checked as reviewed and not applicable.

Security Checklist

• No secrets, tokens, passwords, cookies, or private user data are committed
• Authorization and role boundaries are unchanged or documented
• User input is validated or sanitized
• File upload/download behavior is safe
• HTML/Markdown rendering is sanitized when applicable
• SQL changes avoid injection-prone dynamic concatenation
• Security impact not applicable; reason: no authentication, authorization, upload, or SQL behavior change in this release

Risk and Rollback

• Main risks: repository-local design-system resolution, cache key behavior, and asynchronous execution timing.
• Rollback plan: restore the v2.4.0 backend Jar and both frontend static bundles through the existing release backup.
• Data migration rollback: not required; no schema or data migration.
• Feature flag/config fallback: no new flag or config is required.

Screenshots or Evidence

• VitePress desktop/mobile, dark mode, navigation, search, table overflow, and focus appearance were verified with Playwright.
• Build and audit evidence is summarized above.

Notes for Reviewers

• Focus review on cache/executor ownership boundaries, the shared design-system package references, regenerated Flatten POMs, and documentation audit coverage.