fix(deploy): 使用站点专属 NodePort

HostPort 被命名空间 PodSecurity baseline 拒绝，因此恢复无特权 Pod 配置，并为宁波、香港的 API/Web 增加只选择本站 Pod 的专属 NodePort Service。双 NGINX 和验收脚本按站点使用 31088/31089 与 31178/31179，避免主机本地访问共享 NodePort 时随机命中不可达的跨站 Pod。\n\n验证：kubectl kustomize、服务端 dry-run、bash -n、ShellCheck、无 hostPort/hostIP、git diff --check。

scripts/cluster/migrate-production.sh

@@ -329,13 +329,14 @@ echo '[cutover] starting both application sites with River workers frozen'
 AI_GATEWAY_ACTIVATE_WORKERS=false \
   "$script_dir/bootstrap-platform.sh" activate "$release_manifest"
 
-for site_ip in 10.77.0.1 10.77.0.2; do
+for site_endpoint in 10.77.0.1:31088:31178 10.77.0.2:31089:31179; do
+  IFS=: read -r site_ip api_port web_port <<<"$site_endpoint"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/healthz >/dev/null"
+    "curl -fsS --max-time 10 http://$site_ip:$api_port/api/v1/healthz >/dev/null"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31088/api/v1/readyz | grep -q '\"ok\":true'"
+    "curl -fsS --max-time 10 http://$site_ip:$api_port/api/v1/readyz | grep -q '\"ok\":true'"
   cluster_ssh "$CLUSTER_NINGBO_HOST" \
-    "curl -fsS --max-time 10 http://$site_ip:31178/ | grep -q 'EasyAI AI Gateway'"
+    "curl -fsS --max-time 10 http://$site_ip:$web_port/ | grep -q 'EasyAI AI Gateway'"
 done
 
 "$script_dir/install-nginx-edges.sh" activate

scripts/cluster/run-cross-node-file-e2e.sh

@@ -32,7 +32,7 @@ k3s kubectl set env deployment/easyai-api-ningbo -n easyai \
   AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED=false >/dev/null
 k3s kubectl rollout status deployment/easyai-api-ningbo -n easyai --timeout=300s
 curl -fsS http://10.77.0.1:31088/api/v1/readyz | grep -q '"ok":true'
-curl -fsS http://10.77.0.2:31088/api/v1/readyz | grep -q '"ok":true'
+curl -fsS http://10.77.0.2:31089/api/v1/readyz | grep -q '"ok":true'
 REMOTE
 
 credentials_file=$(mktemp "$cluster_root/.local-secrets/cluster/e2e.XXXXXX")