feat(deploy): 增加三节点 K3s 高可用迁移能力

新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。

新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。

所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。

验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。

deploy/kubernetes/production/database.yaml

@@ -0,0 +1,113 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: easyai-postgres-oss
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  retentionPolicy: 14d
+  configuration:
+    destinationPath: s3://wangbo0808/easyai-ai-gateway/production/postgresql
+    endpointURL: https://oss-cn-shanghai.aliyuncs.com
+    s3Credentials:
+      accessKeyId:
+        name: easyai-oss-backup
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: easyai-oss-backup
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
+      maxParallel: 2
+    data:
+      compression: gzip
+      jobs: 2
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_DEFAULT_REGION
+        value: oss-cn-shanghai
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
+      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
+        value: when_required
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: easyai-postgres
+  labels:
+    app.kubernetes.io/name: easyai-postgres
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.4-standard-trixie@sha256:4587df73024408f5b2be9b4dd6ba2ccee8c9e5dc0c9a87c274c292291cc8a68c
+  imagePullPolicy: IfNotPresent
+  primaryUpdateStrategy: unsupervised
+  primaryUpdateMethod: switchover
+  failoverDelay: 0
+  switchoverDelay: 60
+  stopDelay: 90
+  smartShutdownTimeout: 30
+  bootstrap:
+    initdb:
+      database: easyai_ai_gateway
+      owner: easyai
+      secret:
+        name: easyai-postgres-app
+      postInitSQL:
+        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
+  storage:
+    storageClass: local-path
+    size: 20Gi
+  walStorage:
+    storageClass: local-path
+    size: 5Gi
+  affinity:
+    enablePodAntiAffinity: true
+    podAntiAffinityType: required
+    topologyKey: easyai.io/site
+    nodeSelector:
+      easyai.io/database: "true"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 3Gi
+  postgresql:
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
+    parameters:
+      archive_timeout: 60s
+      max_connections: "200"
+      shared_buffers: 512MB
+      wal_compression: "on"
+      wal_keep_size: 1GB
+  monitoring:
+    enablePodMonitor: false
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: easyai-postgres-oss
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: easyai-postgres-daily
+  labels:
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  # Six-field cron, UTC: 18:30 UTC is 02:30 Asia/Shanghai.
+  schedule: "0 30 18 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: easyai-postgres
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+  immediate: false
+  suspend: false