feat(deploy): 增加三节点 K3s 高可用迁移能力

新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。

新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。

所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。

验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。

deploy/kubernetes/production/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: easyai
+resources:
+  - namespace.yaml
+  - service-account-rbac.yaml
+  - application-config.yaml
+  - application.yaml
+  - database.yaml
+  - network-policy.yaml
+images:
+  # Deployment tooling must replace both sentinel digests with release-manifest
+  # digests before server-side apply.
+  - name: easyai-api
+    newName: registry.cn-shanghai.aliyuncs.com/easyaigc/ai-gateway
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
+  - name: easyai-web
+    newName: registry.cn-shanghai.aliyuncs.com/easyaigc/ai-gateway-web
+    digest: sha256:0000000000000000000000000000000000000000000000000000000000000000