fix(docker): 构建时按 TARGETARCH 下载 kubectl，移除 backend/kubectl 依赖

- 新增 scripts/install-kubectl.sh，支持 linux amd64/arm64
- Dockerfile.embed 后端 CGO 编译跟随 TARGETARCH，修复 Mac ARM 构建失败
- backend/Dockerfile 同步改为构建时下载 kubectl

scripts/install-kubectl.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+# 按目标 OS/ARCH 下载 kubectl（Docker 构建 / 本地脚本共用）// Logan.Li
+set -eu
+
+KUBECTL_VERSION="${KUBECTL_VERSION:-v1.32.2}"
+TARGET_OS="${TARGET_OS:-linux}"
+TARGET_ARCH="${TARGET_ARCH:-amd64}"
+DEST="${1:-/usr/local/bin/kubectl}"
+
+case "${TARGET_ARCH}" in
+    amd64|x86_64)  KARCH=amd64 ;;
+    arm64|aarch64) KARCH=arm64 ;;
+    *)
+        echo "[install-kubectl] 不支持的架构: ${TARGET_ARCH}" >&2
+        exit 1
+        ;;
+esac
+
+# 容器内固定 linux；本地 Mac 调试可 TARGET_OS=darwin
+case "${TARGET_OS}" in
+    linux|darwin) ;;
+    *)
+        echo "[install-kubectl] 不支持的平台: ${TARGET_OS}" >&2
+        exit 1
+        ;;
+esac
+
+PRIMARY="https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/${TARGET_OS}/${KARCH}/kubectl"
+FALLBACK="https://storage.googleapis.com/kubernetes-release/release/${KUBECTL_VERSION}/bin/${TARGET_OS}/${KARCH}/kubectl"
+
+echo "[install-kubectl] ${TARGET_OS}/${KARCH} ${KUBECTL_VERSION} -> ${DEST}"
+
+if curl -fsSL --retry 3 --retry-delay 2 --connect-timeout 20 "${PRIMARY}" -o "${DEST}"; then
+    :
+elif curl -fsSL --retry 3 --retry-delay 2 --connect-timeout 20 "${FALLBACK}" -o "${DEST}"; then
+    echo "[install-kubectl] 使用备用源: ${FALLBACK}"
+else
+    echo "[install-kubectl] 下载失败: ${PRIMARY}" >&2
+    exit 1
+fi
+
+chmod +x "${DEST}"
+"${DEST}" version --client=true 2>/dev/null || true