feat: K8s 部署清单、Token 接入加固与日志/设置页优化

- kubernetes/: 30Gi PVC、单副本 Recreate、Secret/Service/NodePort/Ingress 清单与部署文档
- 数据安全: kubeconfig/token 统一加密存储，启动迁移历史明文，DB 0600
- Token 接入: 命名空间级最小权限提示、长期 Token、自签证书 TLS 兼容
- 部署: 命名空间级 Token 下跳过 Namespace patch/枚举，节点信息容错
- 日志页: namespace → app → pod 选择顺序与作用域收窄
- 设置页: 拆分为通用/告警/LDAP/镜像源四个 tab
- 弹框: 统一 max-h 滚动与长命令换行，修复内容溢出

backend/services/log_source.go

@@ -319,32 +319,63 @@ func DeleteLogSource(id uint) error {
 	return fmt.Errorf("数据源不存在")
 }
 
-// EnsureLogSourceForDeployment 部署成功后自动注册查询数据源(host-binary→url;k8s→cluster-svc)
+// EnsureLogSourceForDeployment 部署成功后自动注册查询数据源(host→url;k8s→cluster-svc)。
+// 已存在同名数据源时：平台托管的自动刷新连接信息，用户手填的不覆盖。
 func EnsureLogSourceForDeployment(d *models.LokiDeployment) {
 	if d == nil || d.Endpoint == "" {
 		return
 	}
+	svc := "loki"
+	port := 3100
+	target := &models.LogSource{
+		Name: d.Name, TargetType: "cluster-svc",
+		ClusterID: d.ClusterID, Namespace: d.Namespace, Service: svc, Port: port,
+		AuthType: "none", Managed: true,
+	}
+	if d.Mode == "host-binary" || d.Mode == "host-docker" {
+		target.TargetType = "url"
+		target.URL = d.Endpoint
+		target.ClusterID = nil
+	}
+
+	db := repository.GetDB()
+	db.Lock()
+	for i := range db.LogSources {
+		if db.LogSources[i].Name != target.Name {
+			continue
+		}
+		if !db.LogSources[i].Managed {
+			db.Unlock()
+			return
+		}
+		db.LogSources[i].TargetType = target.TargetType
+		db.LogSources[i].ClusterID = target.ClusterID
+		db.LogSources[i].Namespace = target.Namespace
+		db.LogSources[i].Service = target.Service
+		db.LogSources[i].Port = target.Port
+		db.LogSources[i].URL = target.URL
+		db.LogSources[i].UpdatedAt = time.Now()
+		db.Unlock()
+		db.RequestSave()
+		return
+	}
+	db.Unlock()
+	_, _ = CreateLogSource(target)
+}
+
+// EnsureLogSourcesForRunningDeployments 补齐运行中部署的数据源，避免查询页默认没有数据源。
+func EnsureLogSourcesForRunningDeployments() {
 	db := repository.GetDB()
 	db.RLock()
-	for i := range db.LogSources {
-		if db.LogSources[i].Name == d.Name {
-			db.RUnlock()
-			return
+	running := make([]models.LokiDeployment, 0, len(db.Deployments))
+	for i := range db.Deployments {
+		d := db.Deployments[i]
+		if d.Status == "running" && d.Endpoint != "" {
+			running = append(running, d)
 		}
 	}
 	db.RUnlock()
-
-	svc := "loki"
-	port := 3100
-	src := &models.LogSource{
-		Name: d.Name, TargetType: "cluster-svc",
-		ClusterID: d.ClusterID, Namespace: d.Namespace, Service: svc, Port: port,
-		AuthType: "none",
+	for i := range running {
+		EnsureLogSourceForDeployment(&running[i])
 	}
-	if d.Mode == "host-binary" || d.Mode == "host-docker" {
-		src.TargetType = "url"
-		src.URL = d.Endpoint
-		src.ClusterID = nil
-	}
-	_, _ = CreateLogSource(src)
 }