fix: 审查修复波次（P0x4 + P1x30+）

- domain/rules: 计分与排名解耦、破纪录按组别、tieBreak 生效、调整分不丢、移除 aggregate 假能力
- realtime: 新建 internal/dto，快照三项契约对齐，/ws 只认会话身份
- httpapi: 流水幂等、standings 整表载荷、广播接线、强制改密、XFF 防伪造、records 写入、审计、赛事包内容、发布前备份、result.points、实例列表
- web: FormData 上传、YAML 解析、快照归一化、大屏解析层、bootstrap 降级、访客判定、主题切换
- console: 优雅关闭握手、中文化、免验证改管理员账号、选屏与日志轮转修复
- docs: 用户文档三份 + README
- 主代理: 破纪录加分接线（levels 未加载导致恒 0）

server/internal/httpapi/export_handlers.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"context"
 	"io"
 	"net/http"
 	"net/url"
@@ -10,6 +11,7 @@ import (
 
 	"git.yeij.top/AskaEth/Scoreboard/server/internal/auth"
 	"git.yeij.top/AskaEth/Scoreboard/server/internal/export"
+	"git.yeij.top/AskaEth/Scoreboard/server/internal/rules"
 )
 
 const xlsxMIME = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
@@ -98,8 +100,23 @@ func (s *server) exportProjectZip(w http.ResponseWriter, r *http.Request) (any,
 		name = raw
 	}
 
+	opts := export.ProjectExportOptions{Name: name, AppVersion: s.version}
+	if s.projectDir != "" {
+		// uploads 可能还没建过；只在目录存在时打包，否则 copyTree 会报错。
+		uploads := filepath.Join(s.projectDir, "uploads")
+		if info, err := os.Stat(uploads); err == nil && info.IsDir() {
+			opts.UploadsDir = uploads
+		}
+	}
+	rulesPath, cleanup, err := s.writeRulesTempFile(r.Context())
+	if err != nil {
+		return nil, err
+	}
+	defer cleanup()
+	opts.RulesPath = rulesPath
+
 	dst := filepath.Join(dir, "project-"+time.Now().Format("20060102-150405")+".zip")
-	if _, err := export.ExportProjectZip(s.ev, dst, export.ProjectExportOptions{Name: name}); err != nil {
+	if _, err := export.ExportProjectZip(s.ev, dst, opts); err != nil {
 		return nil, internal(err)
 	}
 	defer func() { _ = os.Remove(dst) }()
@@ -110,6 +127,33 @@ func (s *server) exportProjectZip(w http.ResponseWriter, r *http.Request) (any,
 	return nil, errHandled
 }
 
+// writeRulesTempFile 把当前规则包导出成临时 YAML，供赛事项目包内嵌 rules.yaml。
+// 返回的清理函数由调用方 defer，避免临时文件泄漏。
+func (s *server) writeRulesTempFile(ctx context.Context) (string, func(), error) {
+	pack, err := rules.Export(s.ev, rules.Meta{})
+	if err != nil {
+		return "", func() {}, internal(err)
+	}
+	body, err := rules.Marshal(pack)
+	if err != nil {
+		return "", func() {}, internal(err)
+	}
+	f, err := os.CreateTemp("", "scoreboard-rules-*.yaml")
+	if err != nil {
+		return "", func() {}, internal(err)
+	}
+	if _, err := f.Write(body); err != nil {
+		_ = f.Close()
+		_ = os.Remove(f.Name())
+		return "", func() {}, internal(err)
+	}
+	if err := f.Close(); err != nil {
+		_ = os.Remove(f.Name())
+		return "", func() {}, internal(err)
+	}
+	return f.Name(), func() { _ = os.Remove(f.Name()) }, nil
+}
+
 func (s *server) importProjectZip(w http.ResponseWriter, r *http.Request) (any, error) {
 	if err := r.ParseMultipartForm(512 << 20); err != nil {
 		return nil, badRequest("解析上传失败", nil)
@@ -146,6 +190,7 @@ func (s *server) importProjectZip(w http.ResponseWriter, r *http.Request) (any,
 	if err != nil {
 		return nil, badRequest(err.Error(), nil)
 	}
+	s.audit(r.Context(), "project.import", "project", 0, nil, res)
 	return res, nil
 }