feat(deploy): 增加三节点 K3s 高可用迁移能力

新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。

新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。

所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。

验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。

scripts/cluster/install-nginx-edges.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/cluster/common.sh
+source "$script_dir/common.sh"
+
+mode=${1:-prepare}
+[[ $mode == prepare || $mode == activate ]] || {
+  echo 'usage: install-nginx-edges.sh [prepare|activate]' >&2
+  exit 64
+}
+load_cluster_env
+
+nginx_directory="$cluster_root/deploy/nginx"
+for file in ai.51easyai.com-cluster.conf ai.51easyai.com-maintenance.conf \
+  cluster-acceptance-origin-ningbo.conf legacy-static-ningbo.inc \
+  legacy-static-hongkong.inc legacy-static-origin-ningbo.conf; do
+  [[ -f $nginx_directory/$file ]] || {
+    echo "missing NGINX file: $file" >&2
+    exit 1
+  }
+done
+
+cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+install -d -m 0700 /etc/nginx/tls/ai.51easyai.com
+install -m 0644 /etc/letsencrypt/live/ai.51easyai.com/fullchain.pem \
+  /etc/nginx/tls/ai.51easyai.com/fullchain.pem
+install -m 0600 /etc/letsencrypt/live/ai.51easyai.com/privkey.pem \
+  /etc/nginx/tls/ai.51easyai.com/privkey.pem
+REMOTE
+cluster_scp \
+  "$CLUSTER_NINGBO_HOST:/etc/nginx/tls/ai.51easyai.com/fullchain.pem" \
+  "$cluster_root/.local-secrets/cluster/fullchain.pem"
+cluster_scp \
+  "$CLUSTER_NINGBO_HOST:/etc/nginx/tls/ai.51easyai.com/privkey.pem" \
+  "$cluster_root/.local-secrets/cluster/privkey.pem"
+chmod 0600 "$cluster_root/.local-secrets/cluster/privkey.pem"
+
+for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
+  cluster_ssh "$host" 'bash -s' <<'REMOTE'
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+if ! command -v nginx >/dev/null 2>&1; then
+  apt-get update -qq
+  apt-get install -y -qq nginx
+fi
+install -d -m 0755 /etc/nginx/easyai-ai-gateway
+install -d -m 0700 /etc/nginx/tls/ai.51easyai.com
+REMOTE
+  cluster_scp "$cluster_root/.local-secrets/cluster/fullchain.pem" \
+    "$host:/etc/nginx/tls/ai.51easyai.com/fullchain.pem"
+  cluster_scp "$cluster_root/.local-secrets/cluster/privkey.pem" \
+    "$host:/etc/nginx/tls/ai.51easyai.com/privkey.pem"
+  cluster_scp "$nginx_directory/ai.51easyai.com-cluster.conf" \
+    "$host:/etc/nginx/sites-available/ai.51easyai.com-cluster"
+  cluster_scp "$nginx_directory/ai.51easyai.com-maintenance.conf" \
+    "$host:/etc/nginx/sites-available/ai.51easyai.com-maintenance"
+done
+
+cluster_scp "$nginx_directory/legacy-static-ningbo.inc" \
+  "$CLUSTER_NINGBO_HOST:/etc/nginx/easyai-ai-gateway/legacy-static.inc"
+cluster_scp "$nginx_directory/legacy-static-origin-ningbo.conf" \
+  "$CLUSTER_NINGBO_HOST:/etc/nginx/conf.d/easyai-legacy-static-origin.conf"
+cluster_scp "$nginx_directory/cluster-acceptance-origin-ningbo.conf" \
+  "$CLUSTER_NINGBO_HOST:/etc/nginx/conf.d/easyai-cluster-acceptance-origin.conf"
+cluster_scp "$nginx_directory/legacy-static-hongkong.inc" \
+  "$CLUSTER_HONGKONG_HOST:/etc/nginx/easyai-ai-gateway/legacy-static.inc"
+
+for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
+  cluster_ssh "$host" 'bash -s' <<'REMOTE'
+set -euo pipefail
+chmod 0600 /etc/nginx/tls/ai.51easyai.com/privkey.pem
+chmod 0644 /etc/nginx/tls/ai.51easyai.com/fullchain.pem
+nginx -t
+REMOTE
+done
+
+if [[ $mode == activate ]]; then
+  for host in "$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST"; do
+    cluster_ssh "$host" 'bash -s' <<'REMOTE'
+set -euo pipefail
+ln -sfn /etc/nginx/sites-available/ai.51easyai.com-cluster \
+  /etc/nginx/sites-enabled/ai.51easyai.com-cluster
+if [[ -L /etc/nginx/sites-enabled/ai.51easyai.com ]]; then
+  rm -f /etc/nginx/sites-enabled/ai.51easyai.com
+fi
+nginx -t
+systemctl reload nginx
+REMOTE
+  done
+fi
+
+echo "nginx_edges=PASS mode=$mode"