feat(deploy): add k3s deployment foundation and complete offline images

Introduce a self-contained kustomize stack under deploy/k3s covering
namespace, config, placeholder secrets, infra StatefulSets, app
Deployments/Services, migration and minio-init Jobs, and Traefik
Ingress for both tenant and ops hosts. Add Dockerfile.ops-web so the
operations frontend can ship as an nginx image, and extend the offline
package script to build and bundle ops-api, kol-assist-worker, and
ops-web alongside the k3s manifests. Wire the new ops/security knobs
through .env.example and the compose stack.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/scripts/package.sh

@@ -69,6 +69,8 @@ _build() {
 
 _build runtime tenant-api      --build-arg SERVICE=tenant-api
 _build runtime worker-generate --build-arg SERVICE=worker-generate
+_build runtime kol-assist-worker --build-arg SERVICE=kol-assist-worker
+_build runtime ops-api         --build-arg SERVICE=ops-api
 _build runtime scheduler       --build-arg SERVICE=scheduler
 _build migrate migrate         # migrate stage 不需要 SERVICE arg
 
@@ -80,6 +82,14 @@ docker buildx build \
   -f Dockerfile.frontend \
   .
 
+echo "    building ${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}"
+docker buildx build \
+  --platform "${PLATFORM}" \
+  --tag "${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}" \
+  --load \
+  -f Dockerfile.ops-web \
+  .
+
 # ─── 拉取基础设施镜像（指定平台） ─────────────────────────────────────────────
 echo "==> [2/5] 拉取基础设施镜像 (platform: ${PLATFORM})"
 INFRA_IMAGES=(
@@ -103,9 +113,12 @@ mkdir -p "${WORK_DIR}"
 ALL_IMAGES=(
   "${LOCAL_PREFIX}/tenant-api:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/worker-generate:${IMAGE_TAG}"
+  "${LOCAL_PREFIX}/kol-assist-worker:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/scheduler:${IMAGE_TAG}"
+  "${LOCAL_PREFIX}/ops-api:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/migrate:${IMAGE_TAG}"
   "${LOCAL_PREFIX}/frontend:${IMAGE_TAG}"
+  "${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}"
   "postgres:16-alpine"
   "rabbitmq:3.13-management-alpine"
   "redis:7-alpine"
@@ -129,9 +142,11 @@ echo "==> [4/5] 打包部署文件"
 cp "${DEPLOY_DIR}/docker-compose.yaml"         "${WORK_DIR}/"
 cp "${DEPLOY_DIR}/docker-compose.offline.yaml" "${WORK_DIR}/"
 cp "${DEPLOY_DIR}/config.yaml"                 "${WORK_DIR}/"
+cp "${DEPLOY_DIR}/ops-config.yaml"             "${WORK_DIR}/"
 cp "${DEPLOY_DIR}/prompts.yml"                 "${WORK_DIR}/"
 cp "${DEPLOY_DIR}/.env.example"                "${WORK_DIR}/"
 cp "${DEPLOY_DIR}/scripts/load-and-start.sh"   "${WORK_DIR}/deploy.sh"
+cp -R "${DEPLOY_DIR}/k3s"                      "${WORK_DIR}/k3s"
 chmod +x "${WORK_DIR}/deploy.sh"
 
 # 写入元数据，供 load 脚本读取