feat: add Go workload deployment artifacts and split Ingress routing

deploy/ack/secrets.example.yaml

@@ -1,4 +1,6 @@
 # Example only. Replace every placeholder and keep the populated file out of Git.
+# Secrets marked "(local development only)" are not referenced by the first
+# production deployment; keep or drop them as your local workflow requires.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -6,6 +8,7 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
+  # Local development only: the production Web workload holds no RDS credentials.
   DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
 ---
 apiVersion: v1
@@ -15,6 +18,7 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
+  # Manual schema execution only: run database/migrations/*.sql with this role.
   DATABASE_URL: postgresql://MIGRATION_USER:MIGRATION_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
 ---
 apiVersion: v1
@@ -24,6 +28,7 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
+  # Local development only: the Node Worker is not deployed in production.
   ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_WITH_A_LONG_RANDOM_VALUE
 ---
 apiVersion: v1
@@ -33,4 +38,60 @@ metadata:
   namespace: zhinian
 type: Opaque
 stringData:
+  # Shared by the Next.js middleware and the Go backend so both verify the
+  # same session cookies. Keep identical across workloads.
   ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-db
+  namespace: zhinian
+type: Opaque
+stringData:
+  # Application role (least privilege): grants applied manually after the SQL.
+  DATABASE_URL: postgresql://APP_USER:APP_PASSWORD@RDS_INTERNAL_HOST:5432/APP_DATABASE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-bootstrap
+  namespace: zhinian
+type: Opaque
+stringData:
+  # First super administrator, created once at Go startup when no super
+  # administrator exists. Password must be at least 8 characters.
+  ZHINIAN_BOOTSTRAP_ADMIN_PHONE: REPLACE_WITH_ADMIN_PHONE
+  ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD: REPLACE_WITH_STRONG_PASSWORD
+  ZHINIAN_BOOTSTRAP_ADMIN_NAME: 平台超级管理员
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-providers
+  namespace: zhinian
+type: Opaque
+stringData:
+  # Provider credentials. Delete keys for providers you do not use; the Go
+  # workload tolerates missing optional keys and fails closed when an enabled
+  # engine has no credentials.
+  VOLCENGINE_ACCESS_KEY_ID: REPLACE_OR_REMOVE
+  VOLCENGINE_SECRET_ACCESS_KEY: REPLACE_OR_REMOVE
+  JIMENG_IMAGE_GENERATE_46_REQ_KEY: REPLACE_OR_REMOVE
+  EVOLINK_API_KEY: REPLACE_OR_REMOVE
+  SEEDANCE_API_KEY: REPLACE_OR_REMOVE
+  BAILIAN_API_KEY: REPLACE_OR_REMOVE
+  DASHSCOPE_API_KEY: REPLACE_OR_REMOVE
+  ALI_OSS_ACCESS_KEY_ID: REPLACE_OR_REMOVE
+  ALI_OSS_ACCESS_KEY_SECRET: REPLACE_OR_REMOVE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zhinian-go-secrets
+  namespace: zhinian
+type: Opaque
+stringData:
+  ZHINIAN_WEBHOOK_SECRET: REPLACE_WITH_A_LONG_RANDOM_VALUE
+  ZHINIAN_API_KEYS: REPLACE_WITH_PUBLIC_API_KEYS
+  ZHINIAN_INTERNAL_WORKER_TOKEN: REPLACE_OR_REMOVE