feat(cluster): 接入深圳专用 Worker 节点

新增深圳 K3s agent 与四节点 WireGuard 全互联接入脚本，将深圳归入香港逻辑 Worker 池并用污点限制为 Worker 专用。\n\n生产验收支持宁波 0、香港逻辑池 2 的双物理节点基线，补充副本拓扑分散、容量档位、链路巡检和零副本站点校验。\n\n已通过 Go 全量测试、go vet、govulncheck、迁移安全检查、ShellCheck、发布脚本测试、前后端 lint/test/build、Compose 与 Kubernetes 渲染校验。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -55,9 +55,19 @@ source "$config_file"
   echo 'production desired-state bundle is unavailable' >&2
   exit 1
 }
-for capacity_value in \
+for replica_value in \
   "$AI_GATEWAY_WORKER_REPLICAS_NINGBO" \
   "$AI_GATEWAY_WORKER_REPLICAS_HONGKONG" \
+  "$AI_GATEWAY_WORKER_MIN_REPLICAS_NINGBO" \
+  "$AI_GATEWAY_WORKER_MIN_REPLICAS_HONGKONG" \
+  "$AI_GATEWAY_WORKER_MAX_REPLICAS_NINGBO" \
+  "$AI_GATEWAY_WORKER_MAX_REPLICAS_HONGKONG"; do
+  [[ $replica_value =~ ^[0-9]+$ ]] || {
+    echo 'Worker replica configuration must contain non-negative integers' >&2
+    exit 1
+  }
+done
+for capacity_value in \
   "$AI_GATEWAY_ASYNC_WORKER_INSTANCE_HARD_LIMIT" \
   "$AI_GATEWAY_ASYNC_WORKER_HARD_LIMIT" \
   "$AI_GATEWAY_ASYNC_WORKER_GLOBAL_HARD_LIMIT" \
@@ -71,10 +81,6 @@ for capacity_value in \
   "$AI_GATEWAY_DATABASE_MAX_CONN_IDLE_SECONDS" \
   "$AI_GATEWAY_MEDIA_MATERIALIZATION_CONCURRENCY" \
   "$AI_GATEWAY_MEDIA_REQUEST_CONCURRENCY" \
-  "$AI_GATEWAY_WORKER_MIN_REPLICAS_NINGBO" \
-  "$AI_GATEWAY_WORKER_MIN_REPLICAS_HONGKONG" \
-  "$AI_GATEWAY_WORKER_MAX_REPLICAS_NINGBO" \
-  "$AI_GATEWAY_WORKER_MAX_REPLICAS_HONGKONG" \
   "$AI_GATEWAY_WORKER_TARGET_OUTSTANDING_PER_REPLICA" \
   "$AI_GATEWAY_WORKER_SCALE_UP_WINDOW_SECONDS" \
   "$AI_GATEWAY_WORKER_SCALE_DOWN_STABILIZATION_SECONDS" \
@@ -103,6 +109,7 @@ done
 }
 (( AI_GATEWAY_WORKER_REPLICAS_NINGBO <= 16 &&
    AI_GATEWAY_WORKER_REPLICAS_HONGKONG <= 16 &&
+   AI_GATEWAY_WORKER_REPLICAS_NINGBO + AI_GATEWAY_WORKER_REPLICAS_HONGKONG >= 1 &&
    AI_GATEWAY_ASYNC_WORKER_INSTANCE_HARD_LIMIT <= 256 &&
    AI_GATEWAY_ASYNC_WORKER_HARD_LIMIT <= 512 &&
    AI_GATEWAY_ASYNC_WORKER_GLOBAL_HARD_LIMIT <= 512 &&
@@ -332,7 +339,7 @@ restore_application_deployments() {
 rollout_worker_site() {
   local site=$1
   local api_image=$2
-  local replicas
+  local replicas ready_replicas
   case $site in
     ningbo) replicas=$AI_GATEWAY_WORKER_REPLICAS_NINGBO ;;
     hongkong) replicas=$AI_GATEWAY_WORKER_REPLICAS_HONGKONG ;;
@@ -371,8 +378,9 @@ rollout_worker_site() {
   "${kubectl[@]}" rollout status "deployment/easyai-worker-$site" -n "$NAMESPACE" --timeout=300s
   [[ $("${kubectl[@]}" get deployment "easyai-worker-$site" -n "$NAMESPACE" \
     -o jsonpath='{.spec.template.spec.containers[?(@.name=="worker")].env[?(@.name=="AI_GATEWAY_PROCESS_ROLE")].value}') == worker ]]
-  [[ $("${kubectl[@]}" get deployment "easyai-worker-$site" -n "$NAMESPACE" \
-    -o jsonpath='{.status.readyReplicas}') == "$replicas" ]]
+  ready_replicas=$("${kubectl[@]}" get deployment "easyai-worker-$site" -n "$NAMESPACE" \
+    -o json | jq -r '.status.readyReplicas // 0')
+  [[ $ready_replicas == "$replicas" ]]
 }
 
 rollout_capacity_controller() {

deploy/kubernetes/production/application.yaml

@@ -458,6 +458,11 @@ spec:
       nodeSelector:
         easyai.io/site: ningbo
         easyai.io/workload: "true"
+      tolerations:
+        - key: easyai.io/worker-only
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001
@@ -617,6 +622,11 @@ spec:
       nodeSelector:
         easyai.io/site: hongkong
         easyai.io/workload: "true"
+      tolerations:
+        - key: easyai.io/worker-only
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001