feat: Docker image auto-publish to GHCR + Watchtower support

- Add docker-publish.yml workflow: multi-arch (amd64/arm64) build on
every push to master, published to ghcr.io/icebear0828/codex-proxy
- Switch docker-compose.yml from local build to pre-built GHCR image
- Add commented Watchtower service block for automatic updates
- Simplify README Docker section: no git clone needed, just curl configs
- Update dashboard Docker hint to mention Watchtower option
- Add dockerAutoUpdateHint i18n key (en/zh)

.github/workflows/docker-publish.yml

@@ -0,0 +1,52 @@
+name: Publish Docker Image
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: docker-publish
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Read version from package.json
+        id: version
+        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ghcr.io/icebear0828/codex-proxy
+          tags: |
+            type=raw,value=latest
+            type=raw,value=v${{ steps.version.outputs.version }}
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

CHANGELOG.md

@@ -8,6 +8,7 @@
 
 ### Added
 
+- Docker 镜像自动发布：push master 自动构建多架构（amd64/arm64）镜像到 GHCR（`ghcr.io/icebear0828/codex-proxy`），docker-compose.yml 切换为预构建镜像，支持 Watchtower 自动更新
 - 双窗口配额显示：Dashboard 账号卡片同时展示主窗口（小时限制）和次窗口（周限制）的用量百分比、进度条和重置时间，后端 `secondary_window` 不再被忽略
 - 更新弹窗 + 自动重启：点击"有可用更新"弹出 Modal 显示 changelog，一键更新后服务器自动重启、前端自动刷新，零人工干预（git 模式 spawn 新进程、Docker/Electron 显示对应操作指引）
 - Model-aware 多计划账号路由：不同 plan（free/plus/business）的账号自动路由到各自支持的模型，business 账号可继续使用 gpt-5.4 等高端模型 (#57)

README.md

@@ -79,32 +79,48 @@ Docker 就像一个"打包好的盒子"，不需要你自己装各种依赖，
 
 **前置条件**：电脑上已安装 Docker。如果没有，先去 [docker.com](https://www.docker.com/products/docker-desktop/) 下载安装 Docker Desktop。
 
-**第 1 步：下载项目代码**
+**第 1 步：创建项目目录**
 
 打开终端（Windows 搜索"cmd"或"PowerShell"；macOS 搜索"终端"），输入：
 
 ```bash
-git clone https://github.com/icebear0828/codex-proxy.git
-cd codex-proxy
+mkdir codex-proxy && cd codex-proxy
 ```
 
-> 如果提示 `git` 不是命令，需要先安装 Git：去 [git-scm.com](https://git-scm.com/) 下载安装。
-
-**第 2 步：创建配置文件并启动**
+**第 2 步：下载配置文件**
 
 ```bash
+curl -O https://raw.githubusercontent.com/icebear0828/codex-proxy/master/docker-compose.yml
+curl -O https://raw.githubusercontent.com/icebear0828/codex-proxy/master/.env.example
 cp .env.example .env       # 复制一份配置模板
-docker compose up -d        # 启动服务（后台运行）
 ```
 
-**第 3 步：登录**
+> 也可以用 `git clone` 下载完整源码，然后在项目目录中 `docker compose up -d`。
+
+**第 3 步：启动**
+
+```bash
+docker compose up -d        # 拉取镜像并启动（后台运行）
+```
+
+**第 4 步：登录**
 
 打开浏览器，访问 `http://localhost:8080`，用 ChatGPT 账号登录。
 
-> 你的账号数据会保存在项目的 `data/` 文件夹里，重启不会丢失。
+> 你的账号数据会保存在 `data/` 文件夹里，重启不会丢失。
 >
 > **其他 Docker 容器要连本服务？** 用你电脑的局域网 IP（如 `http://192.168.x.x:8080/v1`），不要用 `localhost`。
 
+**可选：自动更新**
+
+取消 `docker-compose.yml` 中 Watchtower 服务的注释，即可实现自动更新：
+
+```bash
+docker compose up -d        # 重新启动，Watchtower 将每小时检查更新
+```
+
+Watchtower 会自动检测新镜像版本，拉取并重启容器，无需手动操作。
+
 ---
 
 ### 方式三：源码运行（开发者 / 想改代码的用户）

docker-compose.yml

@@ -1,6 +1,8 @@
 services:
   codex-proxy:
-    build: .
+    image: ghcr.io/icebear0828/codex-proxy:latest
+    # To build from source instead: comment out 'image' above, uncomment 'build' below
+    # build: .
     extra_hosts:
       - "host.docker.internal:host-gateway"
     ports:
@@ -15,3 +17,11 @@ services:
     environment:
       - NODE_ENV=production
       - PORT=8080
+
+  # -- Automatic updates (uncomment to enable) --
+  # watchtower:
+  #   image: containrrr/watchtower
+  #   volumes:
+  #     - /var/run/docker.sock:/var/run/docker.sock
+  #   command: --cleanup --interval 3600 codex-proxy
+  #   restart: unless-stopped

shared/i18n/translations.ts

@@ -151,6 +151,7 @@ export const translations = {
     dockerUpdateCmd: "Run to update:",
     downloadUpdate: "Download",
     electronUpdateHint: "Updates are handled automatically. Restart the app or check the system tray for update notifications.",
+    dockerAutoUpdateHint: "Or enable Watchtower in docker-compose.yml for automatic updates",
     updateTitle: "Update Available",
     updateRestarting: "Restarting server...",
     updatePulling: "Pulling code...",
@@ -329,6 +330,7 @@ export const translations = {
     dockerUpdateCmd: "\u6267\u884c\u66f4\u65b0\u547d\u4ee4\uff1a",
     downloadUpdate: "\u4e0b\u8f7d",
     electronUpdateHint: "\u66f4\u65b0\u7531\u684c\u9762\u7aef\u81ea\u52a8\u5904\u7406\u3002\u91cd\u542f\u5e94\u7528\u6216\u68c0\u67e5\u7cfb\u7edf\u6258\u76d8\u7684\u66f4\u65b0\u901a\u77e5\u3002",
+    dockerAutoUpdateHint: "\u6216\u5728 docker-compose.yml \u4e2d\u542f\u7528 Watchtower \u5b9e\u73b0\u81ea\u52a8\u66f4\u65b0",
     updateTitle: "\u6709\u53ef\u7528\u66f4\u65b0",
     updateRestarting: "\u6b63\u5728\u91cd\u542f\u670d\u52a1...",
     updatePulling: "\u62c9\u53d6\u4ee3\u7801...",

src/routes/web.ts

@@ -290,7 +290,7 @@ export function createWebRoutes(accountPool: AccountPool): Hono {
         error: "Self-update not available in this deploy mode",
         mode,
         hint: mode === "docker"
-          ? "Run: docker compose pull && docker compose up -d"
+          ? "Run: docker compose pull && docker compose up -d (or enable Watchtower for automatic updates)"
           : mode === "electron"
             ? "Updates are handled automatically by the desktop app. Check the system tray for update notifications, or restart the app to trigger a check."
             : "Git is not available in this environment",

web/src/components/UpdateModal.tsx

@@ -179,12 +179,17 @@ export function UpdateModal({
                 {applying ? t("applyingUpdate") : t("updateNow")}
               </button>
             ) : mode === "docker" ? (
-              <button
-                onClick={() => { navigator.clipboard.writeText("docker compose pull && docker compose up -d"); }}
-                class="px-4 py-2 text-xs font-semibold bg-primary text-white rounded-lg hover:bg-primary-hover transition-colors"
-              >
-                {t("copy")} docker compose pull && docker compose up -d
-              </button>
+              <div class="flex flex-col items-end gap-1.5">
+                <button
+                  onClick={() => { navigator.clipboard.writeText("docker compose pull && docker compose up -d"); }}
+                  class="px-4 py-2 text-xs font-semibold bg-primary text-white rounded-lg hover:bg-primary-hover transition-colors"
+                >
+                  {t("copy")} docker compose pull && docker compose up -d
+                </button>
+                <span class="text-[10px] text-slate-400 dark:text-text-dim">
+                  {t("dockerAutoUpdateHint")}
+                </span>
+              </div>
             ) : (
               <span class="text-xs text-slate-500 dark:text-text-dim italic">
                 {t("electronUpdateHint")}