fix(cluster): 固化宁波 Worker 隧道端口

新宁波节点改用 UDP/443 监听，其他三台节点保留 UDP/51820，并在全量 WireGuard 引导中按节点配置 endpoint 端口。\n\n三轮六向实测均为零丢包，香港 RTT 从 73-77ms 降至 48-53ms；已通过 bash -n、ShellCheck 和差异检查。

scripts/cluster/add-ningbo-worker-node.sh

@@ -18,6 +18,7 @@ require_commands ssh scp shasum
 
 node_name=easyai-ningbo-worker-2
 node_ip=10.77.0.4
+worker_wireguard_port=443
 k3s_version=v1.36.2+k3s1
 k3s_sha256=65a55ec56c24eab44383086166ec620a491952b7e23941a49ddca6e8a4c4b4de
 secret_root="$cluster_root/.local-secrets/cluster"
@@ -91,17 +92,20 @@ REMOTE
   done
 
   cluster_ssh "$CLUSTER_NINGBO_WORKER_HOST" bash -s -- \
+    "$worker_wireguard_port" \
     "${server_keys[0]}" "${server_endpoints[0]}" "${server_ips[0]}" \
     "${server_keys[1]}" "${server_endpoints[1]}" "${server_ips[1]}" \
     "${server_keys[2]}" "${server_endpoints[2]}" "${server_ips[2]}" <<'REMOTE'
 set -euo pipefail
+listen_port=$1
+shift
 private_key=$(cat /etc/wireguard/privatekey)
 umask 077
 temporary_config=$(mktemp /etc/wireguard/wg0.conf.XXXXXX)
 cat >"$temporary_config" <<EOF
 [Interface]
 Address = 10.77.0.4/24
-ListenPort = 51820
+ListenPort = ${listen_port}
 PrivateKey = ${private_key}
 
 [Peer]
@@ -125,16 +129,17 @@ EOF
 chmod 0600 "$temporary_config"
 mv "$temporary_config" /etc/wireguard/wg0.conf
 for peer in "$2" "$5" "$8"; do
-  ufw allow from "$peer" to any port 51820 proto udp comment easyai-wireguard >/dev/null
+  ufw allow from "$peer" to any port "$listen_port" proto udp comment easyai-wireguard >/dev/null
 done
 systemctl enable wg-quick@wg0 >/dev/null
 systemctl restart wg-quick@wg0
 REMOTE
 
   for host in "${server_hosts[@]}"; do
-    cluster_ssh "$host" bash -s -- "$worker_key" "${CLUSTER_NINGBO_WORKER_HOST#*@}" "$node_ip" <<'REMOTE'
+    cluster_ssh "$host" bash -s -- "$worker_key" "${CLUSTER_NINGBO_WORKER_HOST#*@}" \
+      "$node_ip" "$worker_wireguard_port" <<'REMOTE'
 set -euo pipefail
-wg set wg0 peer "$1" allowed-ips "$3/32" endpoint "$2:51820" persistent-keepalive 25
+wg set wg0 peer "$1" allowed-ips "$3/32" endpoint "$2:$4" persistent-keepalive 25
 wg-quick save wg0
 REMOTE
   done
@@ -166,7 +171,7 @@ verify_wireguard() {
       "wg show wg0 latest-handshakes | awk '\$2 > 0 && systime()-\$2 < 180 {count++} END {print count+0}'")
     [[ $recent == 3 ]]
   done
-  echo 'ningbo_worker_wireguard=PASS peers=4 recent_handshakes=12 routing=direct'
+  echo "ningbo_worker_wireguard=PASS peers=4 recent_handshakes=12 routing=direct listen_port=$worker_wireguard_port"
 }
 
 install_agent() {