feat(queue): 增加非文本模型分布式准入队列

使用 PostgreSQL 统一同步与异步非文本任务的并发准入、持久化等待和 Worker 容量分配，并将生产 API 与独立 Worker 角色拆分。

补充策略管理、共享契约、OpenAPI、Kubernetes 双节点 Worker 清单及跨节点验收脚本；未默认启用任何生产 queue_size 策略。

已在原基线完成 Go、前端、迁移、Shell、Kustomize 与长任务容量验收；合入最新主干后将重新执行发布门禁。

deploy/kubernetes/production/application.yaml

@@ -48,6 +48,12 @@ spec:
             - secretRef:
                 name: easyai-ai-gateway-runtime
           env:
+            - name: AI_GATEWAY_PROCESS_ROLE
+              value: api
+            - name: AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED
+              value: "false"
+            - name: AI_GATEWAY_DATABASE_MAX_CONNS
+              value: "16"
             - name: POD_NAMESPACE
               valueFrom:
                 fieldRef:
@@ -56,6 +62,12 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: EASYAI_SITE
+              value: ningbo
           ports:
             - name: http
               containerPort: 8088
@@ -154,6 +166,12 @@ spec:
             - secretRef:
                 name: easyai-ai-gateway-runtime
           env:
+            - name: AI_GATEWAY_PROCESS_ROLE
+              value: api
+            - name: AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED
+              value: "false"
+            - name: AI_GATEWAY_DATABASE_MAX_CONNS
+              value: "16"
             - name: POD_NAMESPACE
               valueFrom:
                 fieldRef:
@@ -162,6 +180,12 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: EASYAI_SITE
+              value: hongkong
           ports:
             - name: http
               containerPort: 8088
@@ -212,6 +236,242 @@ spec:
 ---
 apiVersion: apps/v1
 kind: Deployment
+metadata:
+  name: easyai-worker-ningbo
+  labels:
+    app.kubernetes.io/name: easyai-worker
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-worker
+      easyai.io/site: ningbo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-worker
+        app.kubernetes.io/component: worker
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: ningbo
+    spec:
+      serviceAccountName: easyai-ai-gateway
+      terminationGracePeriodSeconds: 90
+      nodeSelector:
+        easyai.io/site: ningbo
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: worker
+          image: easyai-api
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: easyai-ai-gateway-config
+            - secretRef:
+                name: easyai-ai-gateway-runtime
+          env:
+            - name: AI_GATEWAY_PROCESS_ROLE
+              value: worker
+            - name: AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED
+              value: "true"
+            - name: AI_GATEWAY_DATABASE_MAX_CONNS
+              value: "24"
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: EASYAI_SITE
+              value: ningbo
+          ports:
+            - name: health
+              containerPort: 8088
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 10"]
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: application-data
+              mountPath: /app/data
+            - name: temporary-files
+              mountPath: /tmp
+      volumes:
+        - name: application-data
+          emptyDir:
+            sizeLimit: 5Gi
+        - name: temporary-files
+          emptyDir:
+            sizeLimit: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: easyai-worker-hongkong
+  labels:
+    app.kubernetes.io/name: easyai-worker
+    app.kubernetes.io/component: worker
+    app.kubernetes.io/part-of: easyai-ai-gateway
+spec:
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-worker
+      easyai.io/site: hongkong
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: easyai-worker
+        app.kubernetes.io/component: worker
+        app.kubernetes.io/part-of: easyai-ai-gateway
+        easyai.io/site: hongkong
+    spec:
+      serviceAccountName: easyai-ai-gateway
+      terminationGracePeriodSeconds: 90
+      nodeSelector:
+        easyai.io/site: hongkong
+        easyai.io/workload: "true"
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: worker
+          image: easyai-api
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: easyai-ai-gateway-config
+            - secretRef:
+                name: easyai-ai-gateway-runtime
+          env:
+            - name: AI_GATEWAY_PROCESS_ROLE
+              value: worker
+            - name: AI_GATEWAY_ASYNC_QUEUE_WORKER_ENABLED
+              value: "true"
+            - name: AI_GATEWAY_DATABASE_MAX_CONNS
+              value: "24"
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: EASYAI_SITE
+              value: hongkong
+          ports:
+            - name: health
+              containerPort: 8088
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: health
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 6
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 10"]
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: application-data
+              mountPath: /app/data
+            - name: temporary-files
+              mountPath: /tmp
+      volumes:
+        - name: application-data
+          emptyDir:
+            sizeLimit: 5Gi
+        - name: temporary-files
+          emptyDir:
+            sizeLimit: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: easyai-web-ningbo
   labels:
@@ -529,3 +789,13 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: easyai-web
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: easyai-worker
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: easyai-worker