feat(infra): k8s Helm Chart 演化与备份脚本测试

- 新增 edu-platform 平台级 chart（namespace/configmap/secret/ingress/hpa）
- 新增 api-gateway 服务级 chart（完整迁移自原 manifest）
- 新增 6 个业务服务 chart 桩（iam/core-edu/content/msg/data-ana/ai）
- 删除原 api-gateway-deployment.yaml（已迁移至 helm chart）
- 更新 infra/k8s/README.md 为 Helm Chart 管理说明
- 新增 backup-mysql.sh dry-run 测试脚本（17 断言）

infra/k8s/helm/edu-platform/templates/_helpers.tpl

@@ -0,0 +1,42 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "edu-platform.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Fully qualified app name.
+*/}}
+{{- define "edu-platform.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Common labels.
+*/}}
+{{- define "edu-platform.labels" -}}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+{{ include "edu-platform.selectorLabels" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.global.labels }}
+{{ toYaml . }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Selector labels.
+*/}}
+{{- define "edu-platform.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "edu-platform.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

infra/k8s/helm/edu-platform/templates/configmap.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.configMap.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.configMap.name }}
+  namespace: edu-system
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+data:
+{{- range $k, $v := .Values.configMap.data }}
+  {{ $k }}: {{ $v | quote }}
+{{- end }}
+{{- end }}

infra/k8s/helm/edu-platform/templates/hpa.yaml

@@ -0,0 +1,34 @@
+{{/*
+  全局 HPA 模板示例（参考用）。
+  实际 HPA 应在各服务自身的 chart 中定义，以便针对服务特性调参。
+  本模板在 edu-platform 中默认不渲染（hpa.targetService 为空时跳过）。
+*/}}
+{{- if and .Values.hpa.enabled .Values.hpa.targetService }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ .Values.hpa.targetService }}-hpa
+  namespace: edu-services
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ .Values.hpa.targetService }}
+  minReplicas: {{ .Values.hpa.minReplicas }}
+  maxReplicas: {{ .Values.hpa.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
+{{- end }}

infra/k8s/helm/edu-platform/templates/ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $.Release.Name }}-ingress
+  namespace: edu-ingress
+  labels:
+    {{- include "edu-platform.labels" $ | nindent 4 }}
+  {{- with $.Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ $.Values.ingress.className }}
+  {{- with $.Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ .host }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ .service }}
+                port:
+                  number: {{ .port }}
+          {{- end }}
+{{- end }}
+{{- end }}

infra/k8s/helm/edu-platform/templates/namespace.yaml

@@ -0,0 +1,10 @@
+{{- range .Values.namespaces }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .name }}
+  labels:
+    {{- include "edu-platform.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: {{ .component }}
+{{- end }}

infra/k8s/helm/edu-platform/templates/secret.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.secret.enabled }}
+{{- /*
+  ⚠️ 生产环境警告：不要在 values.yaml 中硬编码真实密钥！
+  推荐方案：使用 External Secrets Operator 对接 Vault / KMS / 云 KMS
+  本模板仅作骨架；空字符串字段不会被渲染（避免覆盖已存在的 Secret）。
+*/ -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.secret.name }}
+  namespace: edu-system
+  labels:
+    {{- include "edu-platform.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation
+type: Opaque
+data:
+{{- range $k, $v := .Values.secret.data }}
+{{- if $v }}
+  {{ $k }}: {{ $v }}
+{{- else }}
+  {{ $k }}: ""  # 占位：部署时通过 --set 或 ExternalSecrets 注入
+{{- end }}
+{{- end }}
+{{- end }}