feat: K8s 部署清单、Token 接入加固与日志/设置页优化

- kubernetes/: 30Gi PVC、单副本 Recreate、Secret/Service/NodePort/Ingress 清单与部署文档
- 数据安全: kubeconfig/token 统一加密存储，启动迁移历史明文，DB 0600
- Token 接入: 命名空间级最小权限提示、长期 Token、自签证书 TLS 兼容
- 部署: 命名空间级 Token 下跳过 Namespace patch/枚举，节点信息容错
- 日志页: namespace → app → pod 选择顺序与作用域收窄
- 设置页: 拆分为通用/告警/LDAP/镜像源四个 tab
- 弹框: 统一 max-h 滚动与长命令换行，修复内容溢出

backend/services/collector_templates.go

@@ -160,8 +160,8 @@ daemonset:
 
 resources:
   limits:
-    cpu: 200m
-    memory: 256Mi
+    cpu: 500m
+    memory: 512Mi
   requests:
     cpu: 100m
     memory: 128Mi
@@ -194,7 +194,7 @@ extraVolumeMounts:
 // 取代 helm 安装 —— 后端无需安装 helm 二进制。
 // relabel 体系与主流 helm chart 对齐:namespace/pod/container/node_name + __path__ 按 pod uid 精确匹配。
 func PromtailDaemonsetYAML(ns, lokiURL, clusterName, labelsJSON string) string {
-	promtailImage := ResolveImage("docker.io/grafana/promtail:3.4.0")
+	promtailImage := ResolveImageFor("promtail", "grafana/promtail", "3.4.0")
 	extLabels := promtailExternalLabels(clusterName, labelsJSON)
 	return fmt.Sprintf(`apiVersion: v1
 kind: ServiceAccount
@@ -310,13 +310,15 @@ spec:
             port: http-metrics
           initialDelaySeconds: 10
           periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 5
         resources:
           requests:
-            cpu: 50m
-            memory: 64Mi
+            cpu: 100m
+            memory: 128Mi
           limits:
-            cpu: 200m
-            memory: 256Mi
+            cpu: 500m
+            memory: 512Mi
         volumeMounts:
         - name: config
           mountPath: /etc/promtail
@@ -447,8 +449,8 @@ func SidecarPatchYAML(configMapName string, mount sidecarLogMount) string {
           mountPath: /tmp
         resources:
           limits:
-            cpu: 200m
-            memory: 256Mi
+            cpu: 500m
+            memory: 512Mi
           requests:
             cpu: 100m
             memory: 128Mi
@@ -470,7 +472,7 @@ func SidecarPatchYAML(configMapName string, mount sidecarLogMount) string {
             port: fluent-bit-http
           initialDelaySeconds: 5
           periodSeconds: 5
-`, volume, configMapName, appMount, ResolveImage("docker.io/fluent/fluent-bit:5.1.5"), mount.volumeName, mount.mountPath, subPath)
+`, volume, configMapName, appMount, ResolveImageFor("fluentbit", "fluent/fluent-bit", "5.1.5"), mount.volumeName, mount.mountPath, subPath)
 }
 
 // indentBlock 给每行加前缀（ConfigMap 嵌入配置需缩进）