fix(deploy): 补齐集群备份兼容与切换前门禁

阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。

同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。

scripts/cluster/failure-drill.sh

@@ -52,12 +52,12 @@ case $drill in
 set -euo pipefail
 primary=$1
 k3s kubectl exec -n easyai "$primary" -c postgres -- \
-  psql -X -v ON_ERROR_STOP=1 -U easyai -d easyai_ai_gateway -c \
+  psql -X -v ON_ERROR_STOP=1 -U postgres -d easyai_ai_gateway -c \
   "INSERT INTO system_settings(setting_key,value) VALUES('ha_acceptance_probe',jsonb_build_object('at',now())) ON CONFLICT(setting_key) DO UPDATE SET value=excluded.value,updated_at=now();" >/dev/null
 for _ in $(seq 1 180); do
   if [[ $(k3s kubectl get cluster easyai-postgres -n easyai -o jsonpath='{.status.readyInstances}') == 2 ]]; then
     replication=$(k3s kubectl exec -n easyai "$primary" -c postgres -- \
-      psql -X -U easyai -d easyai_ai_gateway -At -c \
+      psql -X -U postgres -d easyai_ai_gateway -At -c \
       "SELECT count(*) FROM pg_stat_replication WHERE sync_state IN ('sync','quorum');")
     [[ $replication == 1 ]] && break
   fi
@@ -65,7 +65,7 @@ for _ in $(seq 1 180); do
 done
 [[ ${replication:-0} == 1 ]]
 k3s kubectl exec -n easyai "$primary" -c postgres -- \
-  psql -X -v ON_ERROR_STOP=1 -U easyai -d easyai_ai_gateway -c \
+  psql -X -v ON_ERROR_STOP=1 -U postgres -d easyai_ai_gateway -c \
   "DELETE FROM system_settings WHERE setting_key='ha_acceptance_probe';" >/dev/null
 REMOTE
     echo "database_failure_drill=PASS promotion_seconds=$elapsed old_primary=$old_primary new_primary=$new_primary"