fix(acceptance): 自举线上隔离验收身份

线上验收此前依赖人工准备管理员 Token、专属用户、API Key、参考图片和数据库连接，导致跳过本地验收后仍无法安全、可重复执行。

本提交增加短期 Manager 登录、隔离用户/钱包/API Key 幂等创建、Pod 内脱敏快照导出和合成图片真实上传；敏感材料仅保留在进程或 0600 临时文件中。

验证：bash -n、ShellCheck、验收报告测试、参考图片生成测试、git diff --check。

tests/acceptance/reference-images-test.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+const root = resolve(import.meta.dirname, '../..');
+const output = mkdtempSync(join(tmpdir(), 'easyai-reference-images-'));
+execFileSync('node', [join(root, 'scripts/acceptance/generate-reference-images.mjs'), output]);
+
+const hashes = new Set();
+for (let index = 1; index <= 3; index += 1) {
+  const path = join(output, `production-acceptance-reference-${index}.png`);
+  const payload = readFileSync(path);
+  assert.deepEqual([...payload.subarray(0, 8)], [137, 80, 78, 71, 13, 10, 26, 10]);
+  assert.equal(payload.readUInt32BE(16), 512);
+  assert.equal(payload.readUInt32BE(20), 512);
+  assert.equal(statSync(path).mode & 0o777, 0o600);
+  hashes.add(createHash('sha256').update(payload).digest('hex'));
+}
+assert.equal(hashes.size, 3);