fix: cleanup k8s configs, add deploy.sh, remove hardcoded secrets

- Add one-click deploy script (k8s/deploy.sh) for test + prod
- Add startupProbe to backend (60x10s = 10min grace for ML model loading)
- Add configmap.yaml and secret.yaml (envsubst from backend/.env)
- Fix image URLs: add registry.plfai.cn prefix
- Fix frontend: API base URL relative (/api/v1), login-required mode
- Remove hardcoded localhost references from frontend
- Clean broken kustomize overlays
- Add nodeAffinity for backend→k8smaster, frontend→plf-cvm/k8smaster
- Remove dead ReplicaSets and stale pods during deploy

frontend/src/app/api.ts

@@ -4,7 +4,7 @@
  * All functions return the `data` field; throw ApiError on code !== 0
  */
 
-const BASE = 'http://localhost:8000/api/v1';
+const BASE = '/api/v1';
 
 export class ApiError extends Error {
   code: number;

frontend/src/app/auth.ts

@@ -13,9 +13,7 @@ export async function initKeycloak(): Promise<boolean> {
 
   try {
     const authenticated = await keycloak.init({
-      onLoad: 'check-sso',
-      silentCheckSsoRedirectUri:
-        window.location.origin + '/silent-check-sso.html',
+      onLoad: 'login-required',
       pkceMethod: 'S256',
     });
     _initialized = true;

frontend/src/app/components/layout/Header.tsx

@@ -163,7 +163,7 @@ export function Header() {
           className="inline-block w-2 h-2 rounded-full"
           style={{ background: allOk ? 'var(--green)' : 'var(--red)' }}
         />
-        <span style={{ color: 'var(--text-3)', fontSize: 12 }}>API: localhost:8000</span>
+        <span style={{ color: 'var(--text-3)', fontSize: 12 }}>API: /api/v1</span>
       </div>
     </header>
   );

frontend/src/app/components/pages/QAChat.tsx

@@ -79,7 +79,7 @@ export function QAChat() {
       setMessages(prev => [...prev, {
         id: `err${Date.now()}`,
         role: 'ai',
-        content: `⚠️ 请求失败：${msg}\n\n请确认：\n1. 后端服务已启动（localhost:8000）\n2. 知识图谱已有数据（请先上传并索引文档）\n3. DeepSeek API Key 已配置`,
+        content: `⚠️ 请求失败：${msg}\n\n请确认：\n1. 后端服务已启动\n2. 知识图谱已有数据（请先上传并索引文档）\n3. DeepSeek API Key 已配置`,
         timestamp: new Date().toISOString(),
       }]);
     } finally {