feat(k3s): add optional Kite dashboard addon

Apply with `kubectl apply -f deploy/k3s/addons/kite.yaml` to expose a
Kubernetes management dashboard on NodePort 30082. Documented as
optional and intranet-only since the official manifest binds
cluster-admin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/k3s/README.md

@@ -61,6 +61,21 @@ kubectl -n geo-rankly delete job migrate --ignore-not-found
 kubectl apply -k deploy/k3s
 ```
 
+### 3.1 可选安装 Kite dashboard
+
+Kite dashboard 用于管理 k3s/Kubernetes 资源，默认安装到 `kube-system`，并通过 NodePort 暴露：
+
+```bash
+kubectl apply -f deploy/k3s/addons/kite.yaml
+```
+
+访问：
+
+- Kite dashboard: `http://<node-ip>:30082`
+- NAS 示例：`http://192.168.100.19:30082`
+
+注意：Kite 官方清单绑定了 `cluster-admin` 权限，只建议在可信内网使用，不要直接暴露到公网。
+
 ## 4. 访问
 
 k3s 默认同时支持两种访问方式。

deploy/k3s/addons/kite.yaml

@@ -0,0 +1,83 @@
+# Source: https://github.com/kite-org/kite/blob/main/deploy/install.yaml
+# Exposes Kite through NodePort 30082 for LAN-only dashboard access.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kite
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: kite
+    namespace: kube-system
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: kite
+  namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: kite
+  name: kite
+  namespace: kube-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kite
+  template:
+    metadata:
+      labels:
+        app: kite
+    spec:
+      serviceAccountName: kite
+      containers:
+        - image: ghcr.io/kite-org/kite:latest
+          imagePullPolicy: IfNotPresent
+          name: kite
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 512Mi
+            requests:
+              cpu: 100m
+              memory: 128Mi
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: kite
+  name: kite
+  namespace: kube-system
+spec:
+  selector:
+    app: kite
+  type: NodePort
+  ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+      nodePort: 30082