feat: K8s 部署清单、Token 接入加固与日志/设置页优化

- kubernetes/: 30Gi PVC、单副本 Recreate、Secret/Service/NodePort/Ingress 清单与部署文档
- 数据安全: kubeconfig/token 统一加密存储，启动迁移历史明文，DB 0600
- Token 接入: 命名空间级最小权限提示、长期 Token、自签证书 TLS 兼容
- 部署: 命名空间级 Token 下跳过 Namespace patch/枚举，节点信息容错
- 日志页: namespace → app → pod 选择顺序与作用域收窄
- 设置页: 拆分为通用/告警/LDAP/镜像源四个 tab
- 弹框: 统一 max-h 滚动与长命令换行，修复内容溢出

backend/services/loki_config.go

@@ -113,10 +113,11 @@ func (d *LokiDeployer) generateLokiConfig() string {
 	compactorStore := "filesystem"
 
 	switch storageType {
-	case "s3", "oss", "minio":
+	case "s3", "oss", "minio", "cos", "obs":
 		objectStore = "s3"
 		rulerStore = "s3"
-		compactorStore = "s3"
+		// 删除请求存本地盘，避免各云 S3 兼容实现差异导致 compactor 启动失败
+		compactorStore = "filesystem"
 	case "gcs":
 		objectStore = "gcs"
 		rulerStore = "gcs"
@@ -201,13 +202,19 @@ func (d *LokiDeployer) buildStorageConfigBlock() string {
     secret_access_key: %s
     insecure: %s
     s3forcepathstyle: true`, sc.Bucket, endpoint, sc.Region, accessKey, secretKey, insecure)
-	case "oss":
-		return fmt.Sprintf(`  alibabacloud:
-    bucket: %s
+	case "oss", "cos", "obs":
+		insecure := "false"
+		if sc.Insecure {
+			insecure = "true"
+		}
+		return fmt.Sprintf(`  aws:
+    bucketnames: %s
     endpoint: %s
     region: %s
     access_key_id: %s
-    secret_access_key: %s`, sc.Bucket, sc.Endpoint, sc.Region, accessKey, secretKey)
+    secret_access_key: %s
+    insecure: %s
+    s3forcepathstyle: false`, sc.Bucket, sc.Endpoint, sc.Region, accessKey, secretKey, insecure)
 	case "minio":
 		insecure := "false"
 		if sc.Insecure {
@@ -259,13 +266,19 @@ func (d *LokiDeployer) buildRulerStorageBlock() string {
       secret_access_key: %s
       insecure: %s
       s3forcepathstyle: true`, sc.Bucket, endpoint, sc.Region, accessKey, secretKey, insecure)
-	case "oss":
+	case "oss", "cos", "obs":
+		insecure := "false"
+		if sc.Insecure {
+			insecure = "true"
+		}
 		return fmt.Sprintf(`    s3:
       bucketnames: %s
       endpoint: %s
+      region: %s
       access_key_id: %s
       secret_access_key: %s
-      s3forcepathstyle: true`, sc.Bucket, sc.Endpoint, accessKey, secretKey)
+      insecure: %s
+      s3forcepathstyle: false`, sc.Bucket, sc.Endpoint, sc.Region, accessKey, secretKey, insecure)
 	case "minio":
 		insecure := "false"
 		if sc.Insecure {
@@ -341,8 +354,8 @@ compactor:
   retention_delete_delay: 2h
 limits_config:
   retention_period: %dh
-  ingestion_rate_mb: 16
-  ingestion_burst_size_mb: 32
+  ingestion_rate_mb: 64
+  ingestion_burst_size_mb: 128
 schema_config:
   configs:
     - from: "2024-01-01"