fix(cluster): 经宁波中继深圳香港链路

香港与深圳公网直连出现高丢包和高时延时，固定将两地 WireGuard 数据前缀经宁波转发，同时保留直接 peer 心跳。\n\n中继规则和转发状态持久化，接入与全量 WireGuard 引导脚本保持一致；链路验收仍使用端到端丢包和 RTT 硬门禁。\n\n已通过 bash -n、ShellCheck、深圳资源预检和差异检查。

scripts/cluster/bootstrap-wireguard.sh

@@ -90,6 +90,35 @@ systemctl restart wg-quick@wg0
 REMOTE
 done
 
+if (( ${#hosts[@]} == 4 )); then
+  cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- \
+    "${public_keys[0]}" "${public_keys[3]}" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.4/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_SHENZHEN_HOST" bash -s -- \
+    "${public_keys[0]}" "${public_keys[1]}" <<'REMOTE'
+set -euo pipefail
+wg set wg0 peer "$1" allowed-ips 10.77.0.1/32,10.77.0.2/32
+wg set wg0 peer "$2" allowed-ips 0.0.0.0/32
+wg-quick save wg0
+REMOTE
+  cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+sysctl -qw net.ipv4.ip_forward=1
+ensure_forward_rule() {
+  if ! iptables -C FORWARD "$@" 2>/dev/null; then iptables -I FORWARD 1 "$@"; fi
+}
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.2/32 -d 10.77.0.4/32 \
+  -m comment --comment easyai-wireguard-hongkong-shenzhen -j ACCEPT
+ensure_forward_rule -i wg0 -o wg0 -s 10.77.0.4/32 -d 10.77.0.2/32 \
+  -m comment --comment easyai-wireguard-shenzhen-hongkong -j ACCEPT
+netfilter-persistent save >/dev/null
+REMOTE
+fi
+
 for source_index in "${!hosts[@]}"; do
   for target_index in "${!hosts[@]}"; do
     [[ $source_index -eq $target_index ]] && continue
@@ -107,4 +136,8 @@ for host in "${hosts[@]}"; do
   }
 done
 
-echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"
+if (( ${#hosts[@]} == 4 )); then
+  echo 'wireguard_bootstrap=PASS peers=4 hongkong_shenzhen_via=ningbo'
+else
+  echo "wireguard_bootstrap=PASS peers=${#hosts[@]}"
+fi