fix(cluster): 固化宁波 Worker 隧道端口

新宁波节点改用 UDP/443 监听，其他三台节点保留 UDP/51820，并在全量 WireGuard 引导中按节点配置 endpoint 端口。\n\n三轮六向实测均为零丢包，香港 RTT 从 73-77ms 降至 48-53ms；已通过 bash -n、ShellCheck 和差异检查。

scripts/cluster/bootstrap-wireguard.sh

@@ -11,10 +11,12 @@ require_commands ssh scp
 hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
 public_endpoints=("${CLUSTER_NINGBO_HOST#*@}" "${CLUSTER_HONGKONG_HOST#*@}" "${CLUSTER_LOS_ANGELES_HOST#*@}")
 wireguard_ips=(10.77.0.1 10.77.0.2 10.77.0.3)
+wireguard_ports=(51820 51820 51820)
 if [[ -n $CLUSTER_NINGBO_WORKER_HOST ]]; then
   hosts+=("$CLUSTER_NINGBO_WORKER_HOST")
   public_endpoints+=("${CLUSTER_NINGBO_WORKER_HOST#*@}")
   wireguard_ips+=(10.77.0.4)
+  wireguard_ports+=(443)
 fi
 public_keys=()
 
@@ -51,6 +53,7 @@ for local_index in "${!hosts[@]}"; do
       peer_arguments+=(
         "${public_keys[$candidate]}"
         "${public_endpoints[$candidate]}"
+        "${wireguard_ports[$candidate]}"
         "${wireguard_ips[$candidate]}"
       )
     fi
@@ -58,29 +61,31 @@ for local_index in "${!hosts[@]}"; do
   echo "[wireguard] configuring ${hosts[$local_index]} as ${wireguard_ips[$local_index]}"
   cluster_ssh "${hosts[$local_index]}" bash -s -- \
     "${wireguard_ips[$local_index]}" \
+    "${wireguard_ports[$local_index]}" \
     "${peer_arguments[@]}" <<'REMOTE'
 set -euo pipefail
 local_ip=$1
-shift
+local_port=$2
+shift 2
 private_key=$(cat /etc/wireguard/privatekey)
 umask 077
 temporary_config=$(mktemp /etc/wireguard/wg0.conf.XXXXXX)
 cat >"$temporary_config" <<EOF
 [Interface]
 Address = ${local_ip}/24
-ListenPort = 51820
+ListenPort = ${local_port}
 PrivateKey = ${private_key}
 EOF
-while (( $# >= 3 )); do
+while (( $# >= 4 )); do
   cat >>"$temporary_config" <<EOF
 
 [Peer]
 PublicKey = $1
-Endpoint = $2:51820
-AllowedIPs = $3/32
+Endpoint = $2:$3
+AllowedIPs = $4/32
 PersistentKeepalive = 25
 EOF
-  shift 3
+  shift 4
 done
 (( $# == 0 ))
 chmod 0600 "$temporary_config"