fix(deploy): 使用站点专属 NodePort

HostPort 被命名空间 PodSecurity baseline 拒绝，因此恢复无特权 Pod 配置，并为宁波、香港的 API/Web 增加只选择本站 Pod 的专属 NodePort Service。双 NGINX 和验收脚本按站点使用 31088/31089 与 31178/31179，避免主机本地访问共享 NodePort 时随机命中不可达的跨站 Pod。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、无 hostPort/hostIP、git diff --check。

deploy/kubernetes/production/application.yaml

@@ -59,8 +59,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.1
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -167,8 +165,6 @@ spec:
           ports:
             - name: http
               containerPort: 8088
-              hostIP: 10.77.0.2
-              hostPort: 31088
           readinessProbe:
             httpGet:
               path: /api/v1/readyz
@@ -261,8 +257,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.1
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -352,8 +346,6 @@ spec:
           ports:
             - name: http
               containerPort: 80
-              hostIP: 10.77.0.2
-              hostPort: 31178
           readinessProbe:
             httpGet:
               path: /
@@ -434,6 +426,90 @@ spec:
       targetPort: http
       nodePort: 30178
 ---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31088
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-api
+    app.kubernetes.io/component: api
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-api
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 8088
+      targetPort: http
+      nodePort: 31089
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-ningbo-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: ningbo
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: ningbo
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31178
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-hongkong-edge
+  labels:
+    app.kubernetes.io/name: easyai-web
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: easyai-ai-gateway
+    easyai.io/site: hongkong
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  selector:
+    app.kubernetes.io/name: easyai-web
+    easyai.io/site: hongkong
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      nodePort: 31179
+---
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata: