sciagent code + Gitea Actions CI/CD

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/deployment/iis-web-configs/api.web.config

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  web.config cho DYD.Api — ASP.NET Core 10 out-of-process / in-process hosting
+  Đặt ở: C:\inetpub\DYD.Api\web.config
+  Robocopy /XF web.config để không bị overwrite khi deploy.
+-->
+<configuration>
+  <location path="." inheritInChildApplications="false">
+    <system.webServer>
+      <handlers>
+        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
+      </handlers>
+      <aspNetCore processPath="dotnet"
+                  arguments=".\DYD.Api.dll"
+                  stdoutLogEnabled="true"
+                  stdoutLogFile=".\logs\stdout"
+                  hostingModel="InProcess"
+                  forwardWindowsAuthToken="false">
+        <environmentVariables>
+          <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Production" />
+          <!-- Nếu dùng User Secrets / env var cho JWT key, set ở đây hoặc qua IIS Configuration Editor -->
+          <!--
+          <environmentVariable name="ConnectionStrings__DefaultConnection" value="Server=..." />
+          <environmentVariable name="Jwt__SigningKey" value="..." />
+          -->
+        </environmentVariables>
+      </aspNetCore>
+
+      <!-- Security headers -->
+      <httpProtocol>
+        <customHeaders>
+          <add name="X-Content-Type-Options" value="nosniff" />
+          <add name="X-Frame-Options" value="DENY" />
+          <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
+          <add name="Permissions-Policy" value="geolocation=(), microphone=(), camera=()" />
+        </customHeaders>
+      </httpProtocol>
+
+      <!-- Gzip compression -->
+      <httpCompression>
+        <dynamicTypes>
+          <add mimeType="application/json" enabled="true" />
+          <add mimeType="application/json; charset=utf-8" enabled="true" />
+        </dynamicTypes>
+      </httpCompression>
+
+      <!-- Larger file upload (cho InitiativeAttachments) -->
+      <security>
+        <requestFiltering>
+          <!-- 50MB = 52428800 bytes -->
+          <requestLimits maxAllowedContentLength="52428800" />
+        </requestFiltering>
+      </security>
+    </system.webServer>
+  </location>
+</configuration>