fix(cluster): 以宁波专用节点替换深圳 Worker

移除深圳节点及中继拓扑，新增第二台宁波 K3s agent 的全互联 WireGuard 接入和严格 UFW 门禁。\n\nWorker Deployment 与容量控制器仅选择 easyai.io/worker=true 节点，使原宁波混部节点退出 Worker 资源预算，生产基线恢复为宁波专用节点与香港节点各一实例。\n\n已通过 Go 全量测试、go vet、gofmt、迁移安全检查、bash -n、ShellCheck、发布脚本测试和 Kubernetes 清单渲染。

scripts/cluster/bootstrap-wireguard.sh

@@ -11,9 +11,9 @@ require_commands ssh scp
 hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
 public_endpoints=("${CLUSTER_NINGBO_HOST#*@}" "${CLUSTER_HONGKONG_HOST#*@}" "${CLUSTER_LOS_ANGELES_HOST#*@}")
 wireguard_ips=(10.77.0.1 10.77.0.2 10.77.0.3)
-if [[ -n $CLUSTER_SHENZHEN_HOST ]]; then
-  hosts+=("$CLUSTER_SHENZHEN_HOST")
-  public_endpoints+=("${CLUSTER_SHENZHEN_HOST#*@}")
+if [[ -n $CLUSTER_NINGBO_WORKER_HOST ]]; then
+  hosts+=("$CLUSTER_NINGBO_WORKER_HOST")
+  public_endpoints+=("${CLUSTER_NINGBO_WORKER_HOST#*@}")
   wireguard_ips+=(10.77.0.4)
 fi
 public_keys=()
@@ -90,35 +90,6 @@ systemctl restart wg-quick@wg0
 REMOTE
 done
 
-if (( ${#hosts[@]} == 4 )); then
-  cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- \
-    "${public_keys[0]}" "${public_keys[3]}" <<'REMOTE'
-set -euo pipefail
-wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.4/32
-wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
-wg-quick save wg0
-REMOTE
-  cluster_ssh "$CLUSTER_SHENZHEN_HOST" bash -s -- \
-    "${public_keys[0]}" "${public_keys[1]}" <<'REMOTE'
-set -euo pipefail
-wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.2/32
-wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
-wg-quick save wg0
-REMOTE
-  cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
-set -euo pipefail
-sysctl -qw net.ipv4.ip_forward=1
-ensure_forward_rule() {
-  if ! iptables -C FORWARD "$@" 2>/dev/null; then iptables -I FORWARD 1 "$@"; fi
-}
-ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.2/32 -d 10.77.0.4/32 \
-  -m comment --comment easyai-wireguard-hongkong-shenzhen -j ACCEPT
-ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.4/32 -d 10.77.0.2/32 \
-  -m comment --comment easyai-wireguard-shenzhen-hongkong -j ACCEPT
-netfilter-persistent save >/dev/null
-REMOTE
-fi
-
 for source_index in "${!hosts[@]}"; do
   for target_index in "${!hosts[@]}"; do
     [[ $source_index -eq $target_index ]] && continue
@@ -136,8 +107,4 @@ for host in "${hosts[@]}"; do
   }
 done
 
-if (( ${#hosts[@]} == 4 )); then
-  echo 'wireguard_bootstrap=PASS peers=4 hongkong_shenzhen_via=ningbo'
-else
-  echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"
-fi
+echo "wireguard_bootstrap=PASS peers=${#hosts[@]} routing=direct"