fix(cluster): 以宁波专用节点替换深圳 Worker

移除深圳节点及中继拓扑，新增第二台宁波 K3s agent 的全互联 WireGuard 接入和严格 UFW 门禁。\n\nWorker Deployment 与容量控制器仅选择 easyai.io/worker=true 节点，使原宁波混部节点退出 Worker 资源预算，生产基线恢复为宁波专用节点与香港节点各一实例。\n\n已通过 Go 全量测试、go vet、gofmt、迁移安全检查、bash -n、ShellCheck、发布脚本测试和 Kubernetes 清单渲染。

apps/api/internal/capacitycontroller/kubernetes.go

@@ -172,7 +172,9 @@ func (client *KubernetesClient) SiteState(ctx context.Context, site string) (Kub
 			} `json:"status"`
 		} `json:"items"`
 	}
-	nodePath := "/api/v1/nodes?labelSelector=" + url.QueryEscape("easyai.io/site="+site)
+	nodePath := "/api/v1/nodes?labelSelector=" + url.QueryEscape(
+		"easyai.io/site="+site+",easyai.io/worker=true",
+	)
 	if err := client.getJSON(ctx, nodePath, &nodes); err != nil {
 		return KubernetesSiteState{}, err
 	}

apps/api/internal/capacitycontroller/kubernetes_test.go

@@ -27,6 +27,10 @@ func TestKubernetesClientReadsSiteAndMutatesOnlyWorkerScale(t *testing.T) {
 				}]}}}
 			}`))
 		case request.Method == http.MethodGet && request.URL.Path == "/api/v1/nodes":
+			if request.URL.Query().Get("labelSelector") != "easyai.io/site=hongkong,easyai.io/worker=true" {
+				http.Error(w, "unexpected Worker node selector", http.StatusBadRequest)
+				return
+			}
 			_, _ = w.Write([]byte(`{"items":[{"metadata":{"name":"easyai-hongkong"},"status":{
 				"allocatable":{"memory":"8Gi","cpu":"4"},
 				"conditions":[{"type":"MemoryPressure","status":"False"}]