Real channel fetch (Telegram/Bale/Divar) + AI-audited automation engine + CI/CD

- Fetch: Telegram via t.me/s, Bale via Bot API, Divar via web-search (HttpClient, config-gated, graceful)
- AI layer: DB-backed AppSetting (mode auto/manual, thresholds, AI endpoint/model/key/prompt/framework, auto-approve); OpenAI-compatible IAiAuditor (self-host/Iranian endpoints; fails safe to manual)
- Pipeline: fetch → dedupe(hash) → parse → validate → AI audit → Discard/Flag/Queue/auto-publish (resolve-or-create facility)
- Admin: /Admin/Settings automation+AI panel; queue shows confidence + AI verdict; flagged section
- CI/CD: Dockerfile, docker-compose.prod.yml, .gitea/workflows/ci-cd.yml, nginx vhost, DEPLOY.md; forwarded headers + /healthz + prod reference-only seed; ports 22/80/443 only

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOY.md

@@ -69,7 +69,26 @@ ConnectionStrings__Default=Host=db;Port=5432;Database=hamkadr;Username=hamkadr;P
 Auth__AdminPhone=09XXXXXXXXX
 
 # Future: Kavenegar / SMS.ir keys for real OTP delivery
+
+# --- Channel scraping (optional; off by default) ---
+# Enable the background worker and the sources you want, then their fetch runs on a timer.
+# Ingestion__Enabled=true
+# Ingestion__IntervalMinutes=30
+# Telegram (public channels via t.me/s — no token needed):
+# Ingestion__Telegram__Enabled=true
+# Ingestion__Telegram__Channels__0=shift_channel_username
+# Ingestion__Telegram__Channels__1=another_channel
+# Bale (bot must be a member of the channel; Telegram-style Bot API):
+# Ingestion__Bale__Enabled=true
+# Ingestion__Bale__BotToken=__BALE_BOT_TOKEN__
+# Divar (best-effort web-search):
+# Ingestion__Divar__Enabled=true
+# Ingestion__Divar__Queries__0=استخدام پزشک
+# Ingestion__Divar__Queries__1=پرستار
 ```
+> The **AI audit layer** is configured at runtime in the admin panel (`/Admin/Settings`) — endpoint,
+> model, API key, prompt/framework, and auto-approve — not via env. Default: AI off, mode = Manual,
+> so every ingested listing waits in the review queue until an admin publishes it.
 > `POSTGRES_PASSWORD` and the password in `ConnectionStrings__Default` must be identical.
 > `ASPNETCORE_ENVIRONMENT=Production` ⇒ only **reference data** (roles/cities/districts) is seeded —
 > no demo facilities/shifts. Real employers add listings via the employer panel.