fix(deploy): 使用站点专属 NodePort

HostPort 被命名空间 PodSecurity baseline 拒绝，因此恢复无特权 Pod 配置，并为宁波、香港的 API/Web 增加只选择本站 Pod 的专属 NodePort Service。双 NGINX 和验收脚本按站点使用 31088/31089 与 31178/31179，避免主机本地访问共享 NodePort 时随机命中不可达的跨站 Pod。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、无 hostPort/hostIP、git diff --check。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -64,14 +64,24 @@ wait_for_url() {
 verify_site() {
   local site=$1
   local address
+  local api_port
+  local web_port
   case $site in
-    hongkong) address=10.77.0.2 ;;
-    ningbo) address=10.77.0.1 ;;
+    hongkong)
+      address=10.77.0.2
+      api_port=31089
+      web_port=31179
+      ;;
+    ningbo)
+      address=10.77.0.1
+      api_port=31088
+      web_port=31178
+      ;;
     *) return 1 ;;
   esac
-  wait_for_url "$site API health" "http://$address:31088/api/v1/healthz" easyai-ai-gateway
-  wait_for_url "$site API readiness" "http://$address:31088/api/v1/readyz" '"ok":true'
-  wait_for_url "$site Web" "http://$address:31178/" 'EasyAI AI Gateway'
+  wait_for_url "$site API health" "http://$address:$api_port/api/v1/healthz" easyai-ai-gateway
+  wait_for_url "$site API readiness" "http://$address:$api_port/api/v1/readyz" '"ok":true'
+  wait_for_url "$site Web" "http://$address:$web_port/" 'EasyAI AI Gateway'
 }
 
 rollout_site() {

deploy/kubernetes/production/application.yaml

@@ -59,8 +59,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.1
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -167,8 +165,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.2
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -261,8 +257,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.1
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -352,8 +346,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.2
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -434,6 +426,90 @@ spec:
       targetPort: http
       nodePort: 30178
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31088
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31089
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31178
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31179
+---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata: