refactor(cluster): 通用化第四个 Worker 节点接入

将原宁波专用接入脚本改为由环境变量控制节点名称、站点和 WireGuard 端口，支持香港双物理节点 Worker 池。增加候选节点启用开关和服务商网络许可门禁，未明确批准时禁止任何 WireGuard 或 K3s 写操作。同步调整生产验收、巡检、拓扑校验和运行手册。\n\n验证：\n- scripts/cluster 全部 Shell 脚本 bash -n\n- scripts/cluster 全部 ShellCheck\n- git diff --check\n- 本地凭据值扫描\n- 当前三节点 WireGuard/K3s/PostgreSQL 只读基线检查

scripts/cluster/monitor-production-release.sh

@@ -140,8 +140,8 @@ pool_saturated_pods() {
 check_wireguard() {
   local -a hosts=("$CLUSTER_NINGBO_HOST" "$CLUSTER_HONGKONG_HOST" "$CLUSTER_LOS_ANGELES_HOST")
   local -a ips=(10.77.0.1 10.77.0.2 10.77.0.3)
-  [[ -z $CLUSTER_NINGBO_WORKER_HOST ]] || {
-    hosts+=("$CLUSTER_NINGBO_WORKER_HOST")
+  [[ $CLUSTER_WORKER_NODE_4_ENABLED != true ]] || {
+    hosts+=("$CLUSTER_WORKER_NODE_4_HOST")
     ips+=(10.77.0.4)
   }
   local source target output loss average handshakes peer_count