fix: cleanup k8s configs, add deploy.sh, remove hardcoded secrets

- Add one-click deploy script (k8s/deploy.sh) for test + prod
- Add startupProbe to backend (60x10s = 10min grace for ML model loading)
- Add configmap.yaml and secret.yaml (envsubst from backend/.env)
- Fix image URLs: add registry.plfai.cn prefix
- Fix frontend: API base URL relative (/api/v1), login-required mode
- Remove hardcoded localhost references from frontend
- Clean broken kustomize overlays
- Add nodeAffinity for backend→k8smaster, frontend→plf-cvm/k8smaster
- Remove dead ReplicaSets and stale pods during deploy

k8s/overlays/prod/kustomization.yaml

@@ -1,34 +1,11 @@
+# prod 环境 overlay — 仅供参考
+# 实际部署使用项目根目录的 k8s/deploy.sh（支持从 backend/.env 读密钥）
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 namespace: graphrag-prod
-
 namePrefix: prod-
 
 resources:
   - ../../base
   - namespace.yaml
-
-configMapGenerator:
-  - name: graphrag-config
-    behavior: replace
-    literals:
-      - DEEPSEEK_BASE_URL=https://api.deepseek.com
-      - MINERU_PIPELINE=/app/mineru_mvp/pipeline.py
-      - MINERU_PYTHON=/opt/venv/bin/python
-      - KEYCLOAK_SERVER_URL=https://keycloak.plfai.cn
-      - KEYCLOAK_REALM=plfai
-      - KEYCLOAK_CLIENT_ID=graphrag-backend
-      - KEYCLOAK_AUDIENCE=account
-
-secretGenerator:
-  - name: graphrag-secrets
-    behavior: replace
-    literals:
-      - DEEPSEEK_API_KEY=sk-prod-placeholder
-      - MINERU_API_TOKEN=prod-placeholder
-      - KEYCLOAK_CLIENT_SECRET=prod-placeholder
-
-patches:
-  - path: ingress.yaml
-  - path: replicas-patch.yaml