fix(cluster): 经宁波中继深圳香港链路

香港与深圳公网直连出现高丢包和高时延时，固定将两地 WireGuard 数据前缀经宁波转发，同时保留直接 peer 心跳。\n\n中继规则和转发状态持久化，接入与全量 WireGuard 引导脚本保持一致；链路验收仍使用端到端丢包和 RTT 硬门禁。\n\n已通过 bash -n、ShellCheck、深圳资源预检和差异检查。

scripts/cluster/add-shenzhen-worker-node.sh

@@ -135,6 +135,37 @@ wg set wg0 peer "$1" allowed-ips "$3/32" endpoint "$2:51820" persistent-keepaliv
 wg-quick save wg0
 REMOTE
   done
+
+  # The Hong Kong-Shenzhen public route is unstable. Keep the direct peers for
+  # encrypted liveness, but route their data prefixes through Ningbo's healthy
+  # WireGuard paths. AllowedIPs remain unique, so WireGuard selects the relay
+  # deterministically instead of oscillating between direct and relayed paths.
+  cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- \
+    "${server_keys[0]}" "$shenzhen_key" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.4/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_SHENZHEN_HOST" bash -s -- \
+    "${server_keys[0]}" "${server_keys[1]}" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.2/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+sysctl -qw net.ipv4.ip_forward=1
+ensure_forward_rule() {
+  if ! iptables -C FORWARD "$@" 2>/dev/null; then iptables -I FORWARD 1 "$@"; fi
+}
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.2/32 -d 10.77.0.4/32 \
+  -m comment --comment easyai-wireguard-hongkong-shenzhen -j ACCEPT
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.4/32 -d 10.77.0.2/32 \
+  -m comment --comment easyai-wireguard-shenzhen-hongkong -j ACCEPT
+netfilter-persistent save >/dev/null
+REMOTE
   verify_wireguard
 }
 
@@ -162,7 +193,7 @@ verify_wireguard() {
       "wg show wg0 latest-handshakes | awk '\$2 > 0 && systime()-\$2 < 180 {count++} END {print count+0}'")
     [[ $recent == 3 ]]
   done
-  echo 'shenzhen_wireguard=PASS peers=4 recent_handshakes=12'
+  echo 'shenzhen_wireguard=PASS peers=4 recent_handshakes=12 hongkong_shenzhen_via=ningbo'
 }
 
 install_agent() {

scripts/cluster/bootstrap-wireguard.sh

@@ -90,6 +90,35 @@ systemctl restart wg-quick@wg0
 REMOTE
 done
 
+if (( ${#hosts[@]} == 4 )); then
+  cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- \
+    "${public_keys[0]}" "${public_keys[3]}" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.4/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_SHENZHEN_HOST" bash -s -- \
+    "${public_keys[0]}" "${public_keys[1]}" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.2/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+sysctl -qw net.ipv4.ip_forward=1
+ensure_forward_rule() {
+  if ! iptables -C FORWARD "$@" 2>/dev/null; then iptables -I FORWARD 1 "$@"; fi
+}
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.2/32 -d 10.77.0.4/32 \
+  -m comment --comment easyai-wireguard-hongkong-shenzhen -j ACCEPT
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.4/32 -d 10.77.0.2/32 \
+  -m comment --comment easyai-wireguard-shenzhen-hongkong -j ACCEPT
+netfilter-persistent save >/dev/null
+REMOTE
+fi
+
 for source_index in "${!hosts[@]}"; do
   for target_index in "${!hosts[@]}"; do
     [[ $source_index -eq $target_index ]] && continue
@@ -107,4 +136,8 @@ for host in "${hosts[@]}"; do
   }
 done
 
-echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"
+if (( ${#hosts[@]} == 4 )); then
+  echo 'wireguard_bootstrap=PASS peers=4 hongkong_shenzhen_via=ningbo'
+else
+  echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"
+fi