feat(k8s): M14 Namespace 管理看板（资源配额 + 命名空间 CRUD）

- 后端: ListNamespacesDetailed/CreateNamespace/DeleteNamespace/ListResourceQuotas/ListLimitRanges
- 后端: GetNamespacesDetail handler (6 API calls aggregate, not N×3)
- 后端: CreateNamespaceHandler + DeleteNamespaceHandler (system NS protection)
- 前端: NamespaceManagementPage.tsx (~280行) — 表格+概览卡片+创建/删除弹框
- 路由: GET/POST/DELETE /:clusterCode/namespaces + GET /namespace/:ns/detail
- 验证: 9/9 通过 (urllib), TS 零错误, Vite 构建成功

backend/internal/api/routes/routes.go

@@ -389,6 +389,11 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 
 		// Namespace list
 		kubernetesRouter.GET("/:clusterCode/namespaces", k8sHandler.ListNamespaces)
+		// 🆕 M14: Namespace 管理看板 (detail + CRUD)
+		kubernetesRouter.GET("/:clusterCode/namespaces/detail", k8sHandler.GetNamespacesDetail)
+		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/detail", k8sHandler.GetNamespaceDetailHandler)
+		kubernetesRouter.POST("/:clusterCode/namespaces", k8sHandler.CreateNamespaceHandler)
+		kubernetesRouter.DELETE("/:clusterCode/namespaces/:namespace", k8sHandler.DeleteNamespaceHandler)
 		// All-namespace listing (no ns filter)
 		kubernetesRouter.GET("/:clusterCode/deployments", k8sHandler.ListDeploymentsAllNS)
 		kubernetesRouter.GET("/:clusterCode/pods", k8sHandler.ListPodsAllNS)
@@ -411,6 +416,11 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/pvcs", k8sHandler.ListPVCsNS)
 		kubernetesRouter.DELETE("/:clusterCode/namespace/:namespace/pvcs/:name", k8sHandler.DeletePVCNS)
 
+		// RBAC — ServiceAccount / Role / RoleBinding
+		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/serviceaccounts", k8sHandler.ListServiceAccountsNS)
+		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/roles", k8sHandler.ListRolesNS)
+		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/rolebindings", k8sHandler.ListRoleBindingsNS)
+
 		// StatefulSet / DaemonSet
 		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/statefulsets", k8sHandler.ListStatefulSetsNS)
 		kubernetesRouter.GET("/:clusterCode/namespace/:namespace/daemonsets", k8sHandler.ListDaemonSetsNS)
@@ -676,6 +686,8 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		agentGroup.POST("/exec", agentInstallHandler.RemoteExec)
 		// 健康探针：Agent 拉取本机配置（无需 JWT）
 		agentGroup.GET("/health-probes/config", agentHandler.GetHealthProbesForAgent)
+		// 端口策略：Agent 拉取本机端口过滤策略（无需 JWT）
+		agentGroup.GET("/port-policy", agentHandler.GetPortPolicyForAgent)
 	}
 	// Agent 数据查询 + 任务管理（需要 JWT）
 	agentQuery := authorized.Group("/agent")
@@ -710,6 +722,10 @@ func Register(r *gin.Engine, db *gorm.DB, log *zap.Logger, cfg *config.Config, c
 		agentQuery.POST("/health-probes", agentHandler.CreateHealthProbe)
 		agentQuery.PUT("/health-probes/:id", agentHandler.UpdateHealthProbe)
 		agentQuery.DELETE("/health-probes/:id", agentHandler.DeleteHealthProbe)
+
+		// 端口策略（CRUD）
+		agentQuery.GET("/port-policies/:hostname", agentHandler.GetPortPolicy)
+		agentQuery.PUT("/port-policies/:hostname", agentHandler.SavePortPolicy)
 	}
 
 	// Agent 二进制下载（无需鉴权，Agent 升级时使用）