fix(acceptance): 阻断本地控制面漂移污染验收

本地 K3s 节点此前在 Kubelet 中登记为宿主机资源，负载可挤压 etcd 并在 server 重启后继续污染同一 Run。现在为三节点设置真实可调度预算、独立 etcd/数据卷和锁定依赖镜像，并持续核对 server 与 API/etcd 健康。\n\n每次验收生成独立 Run ID，报告使用独占或原子写入，负载错误记录具体阶段；数据库鉴权不可用返回带 Retry-After 的 503，避免基础设施故障被误报为 401。\n\n验证：Go 全量测试、go vet、gofmt、OpenAPI、bash -n、ShellCheck、报告测试和 k3d 配置解析均通过。

apps/api/internal/httpapi/compat_protocol_test.go

@@ -3,6 +3,7 @@ package httpapi
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -13,6 +14,39 @@ import (
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
 )
 
+func TestProtocolAPIKeyStoreFailureIs503InsteadOf401(t *testing.T) {
+	authenticator := auth.New("test-secret", "", "")
+	authenticator.LocalAPIKeyVerifier = func(context.Context, string) (*auth.User, error) {
+		return nil, errors.New("database unavailable")
+	}
+	server := &Server{auth: authenticator}
+	handler := server.requireProtocolUser(clients.ProtocolGeminiGenerateContent, http.HandlerFunc(
+		func(http.ResponseWriter, *http.Request) {
+			t.Fatal("unavailable authentication store must not call the protocol handler")
+		},
+	))
+	request := httptest.NewRequest(http.MethodPost, "/v1beta/models/test:generateContent", nil)
+	request.Header.Set("Authorization", "Bearer sk-gw-local")
+	recorder := httptest.NewRecorder()
+
+	handler.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("status=%d, want 503; body=%s", recorder.Code, recorder.Body.String())
+	}
+	if recorder.Header().Get("Retry-After") != "2" {
+		t.Fatalf("Retry-After=%q, want 2", recorder.Header().Get("Retry-After"))
+	}
+	var body map[string]any
+	if err := json.Unmarshal(recorder.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	errorBody := requireObject(t, body["error"])
+	if errorBody["code"] != float64(http.StatusServiceUnavailable) || errorBody["status"] != "UNAVAILABLE" {
+		t.Fatalf("unexpected Gemini unavailable response: %+v", body)
+	}
+}
+
 func TestProtocolErrorsUseOfficialShapesWithoutGatewayExtensions(t *testing.T) {
 	tests := []struct {
 		name       string