Remove www.ityb.me/careerbot 301 redirect; document 404 behavior

The backward-compat redirect from www.ityb.me/careerbot/* to
career.ityb.me/careerbot/* has been removed per user request.
Now all /careerbot paths on the main domain return 404, except
/careerbot/uploads/* which is served by branch1's secondary mount
so trunk-uploaded photo URLs still render on branch1 pages.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OPS_MANUAL.md

@@ -68,8 +68,9 @@ ssh root@39.106.14.107   # root 直连
 │    → proxy_pass http://127.0.0.1:8001/                         │
 │    → CareerBot branch1 (uvicorn, BASE_PATH="", FAB 隐藏)       │
 │                                                                │
-│  https://www.ityb.me/careerbot/*  (向后兼容)                   │
-│    → 301 redirect https://career.ityb.me/careerbot/...         │
+│  https://www.ityb.me/careerbot/*  → 404（已主动屏蔽）          │
+│  仅 /careerbot/uploads/* 由 branch1 后端兜底（供 trunk 上传      │
+│  的头像 URL 在 branch1 页面正常显示）                           │
 ├────────────────────────────────────────────────────────────────┤
 │  https://career.ityb.me/careerbot/   (完整版 trunk)             │
 │    → proxy_pass http://127.0.0.1:8000/careerbot/                │
@@ -311,11 +312,6 @@ server {
     ssl_certificate     /etc/letsencrypt/live/www.ityb.me/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/www.ityb.me/privkey.pem;
 
-    # 向后兼容：旧的 /careerbot/ URL 跳转到 career 子域名
-    location /careerbot/ {
-        return 301 https://career.ityb.me$request_uri;
-    }
-
     location / {
         proxy_pass http://127.0.0.1:8001/;   # branch1
         proxy_set_header Host $host;
@@ -343,7 +339,7 @@ server {
 关键配置说明：
 - **双域双实例**：career 子域名走 trunk（:8000），主域名走 branch1（:8001）
 - **SSL 证书**：`career.ityb.me` 和 `www.ityb.me+ityb.me` 分别独立证书（均由 certbot 自动申请续期）
-- **向后兼容**：`www.ityb.me/careerbot/*` 自动 301 到 `career.ityb.me/careerbot/*`，老链接不会失效
+- **主域路径隔离**：`www.ityb.me/careerbot/*` 返回 404（nginx 层不做任何特殊处理，请求透传到 branch1 后端，branch1 没有 /careerbot 前缀路由因此 404）；仅 `/careerbot/uploads/*` 能命中 branch1 的二级挂载，用于显示 trunk 管理员上传的头像
 - `proxy_buffering off` + `proxy_cache off`：**必须关闭**，否则 SSE 流式对话无法实时返回
 - `proxy_read_timeout 300s`：LLM 长回复可能需要较长时间