docs(deploy): document pgbouncer rollout

deploy/OFFLINE_PACKAGE.md

@@ -20,6 +20,8 @@ bash deploy.sh
 docker compose -f docker-compose.yaml -f docker-compose.offline.yaml --env-file .env up -d
 ```
 
+Runtime services connect to Postgres through PgBouncer in `session` pooling mode. The one-shot `migrate` job still connects directly to `postgres` and `monitoring-postgres` so DDL and seed work do not go through the pooler.
+
 On a k3s host:
 
 ```bash

deploy/k3s/README.md

@@ -2,7 +2,7 @@
 
 这套清单用于把当前 Docker Compose 拓扑搬到单节点或小集群 k3s 中。默认包含：
 
-- infra: `postgres`, `monitoring-postgres`, `rabbitmq`, `redis`, `qdrant`, `minio`
+- infra: `postgres`, `monitoring-postgres`, `pgbouncer`, `monitoring-pgbouncer`, `rabbitmq`, `redis`, `qdrant`, `minio`
 - jobs: `migrate`, `minio-init`
 - apps: `tenant-api`, `worker-generate`, `kol-assist-worker`, `scheduler`, `ops-api`, `frontend`, `ops-web`
 - ingress: `geo-rankly.local` -> `frontend`, `ops.geo-rankly.local` -> `ops-web`
@@ -38,7 +38,7 @@ sudo k3s ctr images import images.tar
 - `config/config.yaml` 里的 LLM / SiliconFlow API key
 - `config.local.yaml` 里对应的数据库、RabbitMQ、MinIO、JWT 配置
 
-注意：`ops-api` 目前从 `deploy/k3s/config/ops-config.yaml` 读取数据库连接信息；如果改了 Postgres 密码，也同步改这个文件。
+注意：应用运行时通过 `pgbouncer` / `monitoring-pgbouncer` 访问数据库；`migrate` 任务仍然直连 `postgres` / `monitoring-postgres`。数据库密码统一来自 `POSTGRES_PASSWORD` secret，应用配置和 PgBouncer 都会跟随这个 secret。
 
 ## 3. 部署