fix(deploy): 使用站点专属 NodePort

HostPort 被命名空间 PodSecurity baseline 拒绝，因此恢复无特权 Pod 配置，并为宁波、香港的 API/Web 增加只选择本站 Pod 的专属 NodePort Service。双 NGINX 和验收脚本按站点使用 31088/31089 与 31178/31179，避免主机本地访问共享 NodePort 时随机命中不可达的跨站 Pod。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、无 hostPort/hostIP、git diff --check。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -64,14 +64,24 @@ wait_for_url() {
 verify_site() {
   local site=$1
   local address
+  local api_port
+  local web_port
   case $site in
-    hongkong) address=10.77.0.2 ;;
-    ningbo) address=10.77.0.1 ;;
+    hongkong)
+      address=10.77.0.2
+      api_port=31089
+      web_port=31179
+      ;;
+    ningbo)
+      address=10.77.0.1
+      api_port=31088
+      web_port=31178
+      ;;
     *) return 1 ;;
   esac
-  wait_for_url "$site API health" "http://$address:31088/api/v1/healthz" easyai-ai-gateway
-  wait_for_url "$site API readiness" "http://$address:31088/api/v1/readyz" '"ok":true'
-  wait_for_url "$site Web" "http://$address:31178/" 'EasyAI AI Gateway'
+  wait_for_url "$site API health" "http://$address:$api_port/api/v1/healthz" easyai-ai-gateway
+  wait_for_url "$site API readiness" "http://$address:$api_port/api/v1/readyz" '"ok":true'
+  wait_for_url "$site Web" "http://$address:$web_port/" 'EasyAI AI Gateway'
 }
 
 rollout_site() {