feat(deploy): single-image docker-compose and kubernetes install.sh

- multi-stage root Dockerfile (opsx-loki pattern): frontend dist +
  go binary + gh-ost in one alpine image, non-root user, HEALTHCHECK,
  entrypoint warning for missing SECRET_KEY; gin now serves the SPA
  from DIST_DIR (asset/db-logos/favicon passthrough, /api returns JSON
  404, SPA fallback to index.html) - one origin, no CORS surface
- docker-compose.yml rewritten: single service, named data volume,
  no-new-privileges + cap_drop ALL, /health healthcheck, resource
  limits, log rotation; SECRET_KEY required (openssl rand -hex 32),
  JWT_SECRET optional (auto-generated and persisted in prod)
- kubernetes/: install.sh one-command deploy (idempotent secret
  reuse, --nodeport/--ingress flags, rollout wait, backup tips) plus
  namespace/secret/pvc/deployment(single replica + Recreate, probes,
  resource limits, non-root)/service/nodeport/ingress manifests and
  README (sqlite single-writer constraints, snapshot backup)
- docs: README quick-start now has 3 deployment paths; ARCHITECTURE
  ch.14 expanded

single-image runtime verified locally (SPA/assets/api/login coexist
on :9002); full image build left to server (docker hub unreachable
from this machine)

README.md

@@ -88,7 +88,9 @@ sql-platform/
 │       └── lib/              # 工具函数
 ├── tests/                    # 集成测试
 ├── run.sh                    # 启动/停止脚本
-└── docker-compose.yml        # Docker 部署
+├── docker-compose.yml        # Docker Compose 部署(单镜像)
+├── Dockerfile                # 单镜像多阶段构建(前端+后端+gh-ost)
+└── kubernetes/               # K8s 部署(install.sh 一键 + 清单)
 ```
 
 ## 快速开始
@@ -99,18 +101,45 @@ sql-platform/
 - Node.js 18+
 - npm 或 yarn
 
-### 启动
+### 方式一:Docker Compose(推荐,单镜像前后端同源)
 
 ```bash
-# 克隆项目
 git clone https://gitee.com/opsx-tools/opsxsql.git
 cd opsxsql
 
-# Docker 一键启动
-docker-compose up -d --build
+# 生成密钥(必填;SECRET_KEY 部署后不可更换,否则已加密的实例/LDAP 密码无法解密)
+export SECRET_KEY=$(openssl rand -hex 32)
+# 可选;不设则生产模式自动生成随机 JWT 密钥并持久化到数据卷
+export JWT_SECRET=$(openssl rand -hex 32)
+
+docker compose up -d --build
 ```
 
-后端运行在 **http://localhost:9000**，前端运行在 **http://localhost/**
+访问 **http://localhost:9000**(单镜像,Gin 同时托管前端静态资源与 API)。
+自定义端口:`OPSXSQL_PORT=18000 docker compose up -d`。
+安全基线:非 root 运行、no-new-privileges、cap_drop ALL、/health 健康检查、资源限额、日志轮转。
+
+### 方式二:Kubernetes 一键部署
+
+```bash
+# 默认部署(镜像 opsxsql:latest)
+bash kubernetes/install.sh
+
+# 指定镜像 + 入口
+IMAGE=registry.example.com/opsxsql:v1.0.0 bash kubernetes/install.sh --nodeport
+IMAGE=registry.example.com/opsxsql:v1.1.0 bash kubernetes/install.sh --ingress opsxsql.example.com
+```
+
+install.sh 幂等:自动建命名空间/生成并复用密钥/应用 PVC+Deployment+Service,等待就绪后打印访问方式。
+注意:SQLite 单写者,Deployment 固定 **单副本 + Recreate**(脚本已内置);详见 `kubernetes/README.md`。
+
+### 方式三:本地开发
+
+```bash
+./run.sh start    # 后端 9000 + 前端 5173
+```
+
+后端 **http://localhost:9000**,前端 dev server **http://localhost:5173**(vite 代理 /api)。
 
 ### 默认账号