fix(cluster): 以宁波专用节点替换深圳 Worker

移除深圳节点及中继拓扑，新增第二台宁波 K3s agent 的全互联 WireGuard 接入和严格 UFW 门禁。\n\nWorker Deployment 与容量控制器仅选择 easyai.io/worker=true 节点，使原宁波混部节点退出 Worker 资源预算，生产基线恢复为宁波专用节点与香港节点各一实例。\n\n已通过 Go 全量测试、go vet、gofmt、迁移安全检查、bash -n、ShellCheck、发布脚本测试和 Kubernetes 清单渲染。

scripts/cluster/verify-cluster.sh

@@ -15,10 +15,10 @@ load_cluster_env
 hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
 wireguard_ips=(10.77.0.1 10.77.0.2 10.77.0.3)
 site_labels=(ningbo hongkong losangeles)
-if [[ -n $CLUSTER_SHENZHEN_HOST ]]; then
-  hosts+=("$CLUSTER_SHENZHEN_HOST")
+if [[ -n $CLUSTER_NINGBO_WORKER_HOST ]]; then
+  hosts+=("$CLUSTER_NINGBO_WORKER_HOST")
   wireguard_ips+=(10.77.0.4)
-  site_labels+=(shenzhen)
+  site_labels+=(ningbo-worker-2)
 fi
 peer_count=$((${#hosts[@]} - 1))
 for source_index in "${!hosts[@]}"; do
@@ -55,7 +55,7 @@ done
 echo "wireguard_acceptance=PASS peers=${#hosts[@]} handshakes=$((${#hosts[@]} * peer_count)) packet_loss_lt_1=true"
 
 expected_nodes=3
-[[ -z $CLUSTER_SHENZHEN_HOST ]] || expected_nodes=4
+[[ -z $CLUSTER_NINGBO_WORKER_HOST ]] || expected_nodes=4
 cluster_state=$(cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$expected_nodes" <<'REMOTE'
 set -euo pipefail
 expected_nodes=$1
@@ -72,13 +72,14 @@ printf 'nodes=%s\n' "$($kubectl get nodes --no-headers | wc -l)"
 REMOTE
 )
 [[ $cluster_state == nodes="$expected_nodes" ]]
-if [[ -n $CLUSTER_SHENZHEN_HOST ]]; then
+if [[ -n $CLUSTER_NINGBO_WORKER_HOST ]]; then
   worker_state=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
 set -euo pipefail
 kubectl='k3s kubectl'
-node=easyai-shenzhen
+node=easyai-ningbo-worker-2
 [[ $($kubectl get node "$node" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}') == True ]]
-[[ $($kubectl get node "$node" -o jsonpath='{.metadata.labels.easyai\.io/site}') == hongkong ]]
+[[ $($kubectl get node "$node" -o jsonpath='{.metadata.labels.easyai\.io/site}') == ningbo ]]
+[[ $($kubectl get node "$node" -o jsonpath='{.metadata.labels.easyai\.io/worker}') == true ]]
 [[ $($kubectl get node "$node" -o jsonpath='{.metadata.labels.easyai\.io/database}') == false ]]
 [[ $($kubectl get node "$node" -o json | jq '[.spec.taints[]? | select(.key=="easyai.io/worker-only" and .effect=="NoSchedule")] | length') -eq 1 ]]
 [[ $($kubectl get pods -A --field-selector "spec.nodeName=$node" -o json |