chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

deploy/kubernetes/quick-deploy.yaml

@@ -1,6 +1,6 @@
 # quick-deploy.yaml — AIOps 单容器快速部署
 # 部署: kubectl apply -f quick-deploy.yaml
-# 此文件自包含 (ConfigMap + Deployment + Service), 不依赖其他 YAML
+# 此文件为开发演示模板；生产请使用 deployment.yaml + Secret + PVC + NetworkPolicy。 // Logan.Li
 #
 # 两种模式:
 #   远程模式 (默认): MODE=release, 连接外部 MySQL + Redis
@@ -24,9 +24,16 @@ data:
     redis:
       driver: redka
 
-    jwt:
-      secret: "aiops-jwt-secret-key-2026"
-      expire_hour: 24
+---
+# 仅为模板占位符，部署前必须替换为随机值，禁止提交真实生产密钥。 // Logan.Li
+apiVersion: v1
+kind: Secret
+metadata:
+  name: aiops-secret
+  namespace: devops
+type: Opaque
+stringData:
+  jwt-secret: "REPLACE_WITH_RANDOM_JWT_SECRET_AT_LEAST_32_BYTES"
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -53,11 +60,25 @@ spec:
         app.kubernetes.io/name: aiops
         app.kubernetes.io/component: app
     spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: false
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
       initContainers:
         - name: init-local-db
           image: busybox:1.36
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
           command:
             - sh
             - -c
@@ -68,8 +89,9 @@ spec:
               if [ -f /vol/data/redka/redka.db ] && [ ! -f /vol/redka.db ]; then
                 cp /vol/data/redka/redka.db /vol/redka.db
               fi
-              [ -f /vol/sqlite3.db ] || install -m 644 /dev/null /vol/sqlite3.db
-              [ -f /vol/redka.db ] || install -m 644 /dev/null /vol/redka.db
+              [ -f /vol/sqlite3.db ] || install -m 660 /dev/null /vol/sqlite3.db
+              [ -f /vol/redka.db ] || install -m 660 /dev/null /vol/redka.db
+              chown 10001:10001 /vol/sqlite3.db /vol/redka.db
           volumeMounts:
             - name: data
               mountPath: /vol
@@ -86,7 +108,10 @@ spec:
             - name: TZ
               value: Asia/Shanghai
             - name: JWT_SECRET
-              value: "aiops-jwt-secret-key-2026"
+              valueFrom:
+                secretKeyRef:
+                  name: aiops-secret
+                  key: jwt-secret
             # 集群模式 (MODE=release) 时取消注释:
             # - name: DATABASE_DRIVER
             #   value: mysql
@@ -107,6 +132,17 @@ spec:
             - name: data
               mountPath: /app/redka.db
               subPath: redka.db
+            - name: uploads
+              mountPath: /app/uploads
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            seccompProfile:
+              type: RuntimeDefault
           resources:
             requests:
               cpu: 100m
@@ -121,6 +157,9 @@ spec:
         - name: data
           persistentVolumeClaim:
             claimName: aiops-data
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: aiops-uploads
 ---
 apiVersion: v1
 kind: Service