fix(ci): Ubuntu apt 源切 HTTPS 后再装 Playwright 依赖

runner 出网对明文 HTTP（80 端口）持续返回 502，Playwright --with-deps
从 archive/security.ubuntu.com 拉包必然失败（run 1954/1956 三次重试全部
apt exit 100），而同环境 HTTPS 仓库均正常。安装依赖前先把 Ubuntu 源
整体改写为 HTTPS：官方源优先，失败依次切换阿里云、TUNA 镜像，全部
不可用才报错；microsoft/launchpad 等第三方源不受影响。

.gitea/workflows/ci.yml

@@ -82,6 +82,40 @@ jobs:
       - run: uv run python manage.py bootstrap --username admin --organization CI
         env:
           BOOTSTRAP_PASSWORD: ${{ env.E2E_PASSWORD }}
+      # runner 出网对明文 HTTP（80 端口）一律 502，archive/security.ubuntu.com
+      # 的 Ubuntu 源拉不到包；HTTPS 仓库（microsoft、launchpad 等）均正常。
+      # 装 Playwright 系统依赖前把 Ubuntu 源整体切到 HTTPS，官方源优先、镜像兜底。
+      - name: Switch apt sources to HTTPS
+        run: |
+          set -euo pipefail
+          if [ "$(id -u)" -eq 0 ]; then S=""; else S="sudo"; fi
+          sources=$(ls /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || true)
+          [ -n "$sources" ] || { echo "未找到 apt 源文件" >&2; exit 1; }
+          backup=/tmp/apt-sources-orig
+          rm -rf "$backup" && mkdir -p "$backup"
+          $S cp -a /etc/apt/sources.list "$backup/" 2>/dev/null || true
+          $S cp -a /etc/apt/sources.list.d "$backup/"
+          restore() {
+            $S rm -f /etc/apt/sources.list
+            $S find /etc/apt/sources.list.d -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+            $S cp -a "$backup/sources.list" /etc/apt/sources.list 2>/dev/null || true
+            $S cp -a "$backup/sources.list.d/." /etc/apt/sources.list.d/
+          }
+          for mirror in \
+            "${CI_APT_MIRROR:-https://archive.ubuntu.com/ubuntu/}" \
+            https://mirrors.aliyun.com/ubuntu/ \
+            https://mirrors.tuna.tsinghua.edu.cn/ubuntu/; do
+            echo "::group::apt 源 -> $mirror"
+            restore
+            $S sed -E -i "s#https?://([a-z0-9-]+\.)*(archive|security)\.ubuntu\.com/ubuntu/?#$mirror#g" $sources
+            if $S apt-get update -o Acquire::Retries=3; then
+              echo "apt 源已使用 $mirror"
+              exit 0
+            fi
+            echo "::warning::apt 源 $mirror 更新失败，尝试下一个镜像"
+          done
+          echo "所有 apt 镜像均不可用" >&2
+          exit 1
       - name: Install Playwright Chromium
         run: |
           for attempt in 1 2 3; do