feat(acceptance): 建立同构验收与弹性容量体系

实现本地三节点 K3s 同构环境、脱敏生产快照、Gemini 图片和多参考图视频协议模拟、统一验收报告及故障注入。\n\n新增 Worker 容量控制器、资源与连接预算、任务恢复保护，并将生产验收拆分为 validation 执行和人工 CAS 放量。\n\n验证包括 Go 全量测试、PostgreSQL HTTP 集成测试、go vet、OpenAPI、ShellCheck、前端检查、迁移及发布脚本测试。

apps/api/internal/clients/gemini.go

@@ -34,6 +34,7 @@ func (c GeminiClient) Run(ctx context.Context, request Request) (Response, error
 		return Response{}, err
 	}
 	req.Header.Set("Content-Type", "application/json")
+	applyUpstreamIdempotency(req, request)
 	responseStartedAt := time.Now()
 	if err := notifySubmissionStarted(request); err != nil {
 		return Response{}, err

apps/api/internal/clients/types.go

@@ -20,6 +20,7 @@ type Request struct {
 	HTTPClient                  *http.Client
 	RemoteTaskID                string
 	RemoteTaskPayload           map[string]any
+	UpstreamIdempotencyKey      string
 	OnRemoteTaskSubmitted       func(remoteTaskID string, payload map[string]any) error
 	OnRemoteTaskPolled          func(remoteTaskID string, payload map[string]any) error
 	OnUpstreamSubmissionStarted func() error
@@ -34,6 +35,15 @@ type Request struct {
 	PreviousResponseTurns       []ResponseTurn
 }
 
+func applyUpstreamIdempotency(request *http.Request, input Request) {
+	if request == nil {
+		return
+	}
+	if key := strings.TrimSpace(input.UpstreamIdempotencyKey); key != "" {
+		request.Header.Set("Idempotency-Key", key)
+	}
+}
+
 // WireResponse preserves the provider-facing response independently from the
 // canonical result used by billing, retries, and cross-protocol conversion.
 // Headers are filtered before this value leaves the clients package.

apps/api/internal/clients/volces.go

@@ -44,6 +44,7 @@ func (c VolcesClient) runImage(ctx context.Context, request Request, apiKey stri
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Authorization", "Bearer "+apiKey)
+	applyUpstreamIdempotency(req, request)
 
 	responseStartedAt := time.Now()
 	if err := notifySubmissionStarted(request); err != nil {
@@ -232,6 +233,7 @@ func (c VolcesClient) postJSON(ctx context.Context, request Request, baseURL str
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Authorization", "Bearer "+apiKey)
+	applyUpstreamIdempotency(req, request)
 	if err := notifySubmissionStarted(request); err != nil {
 		return nil, "", nil, err
 	}