feat(acceptance): 增加生产同构媒体压力验收模式

引入动态流量门禁、隔离验收身份与协议级 Gemini/Volces 模拟器，覆盖双站点 API、Worker、PostgreSQL、River、账务、回调和媒体物化链路。

新增 P24/P28/P32 容量阶梯、Worker 强杀恢复、真实小流量 canary、CAS 放量和失败保持 validation 的生产编排；Worker 执行槽、连接池、媒体并发和双站点副本数改为环境配置。

验证：Go 全量测试、真实 PostgreSQL 迁移集成测试、迁移安全检查、OpenAPI 生成、ShellCheck、Kustomize、gofmt 和 git diff --check。

apps/api/internal/httpapi/kling_compat.go

@@ -112,6 +112,15 @@ func (s *Server) createKlingCompatTask(w http.ResponseWriter, r *http.Request, v
 		writeKlingCompatError(w, http.StatusForbidden, "api key scope does not allow video generation", "permission_denied")
 		return
 	}
+	admission, err := s.authorizeTaskTraffic(r, user)
+	if err != nil {
+		targetProtocol := clients.ProtocolKlingV1Omni
+		if version == "v2" {
+			targetProtocol = clients.ProtocolKlingV2Omni
+		}
+		writeTaskTrafficError(w, err, targetProtocol)
+		return
+	}
 	body, externalTaskID, err := klingCompatTaskBody(version, model, native)
 	if err != nil {
 		writeKlingCompatError(w, http.StatusBadRequest, err.Error(), clients.ErrorCode(err))
@@ -122,13 +131,23 @@ func (s *Server) createKlingCompatTask(w http.ResponseWriter, r *http.Request, v
 		writeKlingCompatError(w, http.StatusBadRequest, err.Error(), clients.ErrorCode(err))
 		return
 	}
+	runMode, err := s.admittedTaskRunMode(admission, prepared.Body)
+	if err != nil {
+		targetProtocol := clients.ProtocolKlingV1Omni
+		if version == "v2" {
+			targetProtocol = clients.ProtocolKlingV2Omni
+		}
+		writeTaskTrafficError(w, err, targetProtocol)
+		return
+	}
 	createInput := store.CreateTaskInput{
-		Kind:           "videos.generations",
-		Model:          model,
-		ExternalTaskID: externalTaskID,
-		RunMode:        runModeFromRequest(prepared.Body),
-		Async:          true,
-		Request:        prepared.Body,
+		Kind:            "videos.generations",
+		Model:           model,
+		ExternalTaskID:  externalTaskID,
+		RunMode:         runMode,
+		AcceptanceRunID: admission.AcceptanceRunID,
+		Async:           true,
+		Request:         prepared.Body,
 	}
 	if idempotencyKey, hasKey, keyErr := optionalTaskIdempotencyKey(r); keyErr != nil {
 		writeKlingCompatError(w, http.StatusBadRequest, "invalid Idempotency-Key", "invalid_idempotency_key")