feat: add direct PostgreSQL and ACK deployment support

deploy/ack/migration-job.yaml

@@ -0,0 +1,64 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: zhinian-db-migrate
+  namespace: zhinian
+spec:
+  backoffLimit: 2
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: zhinian
+        app.kubernetes.io/component: database-migration
+    spec:
+      restartPolicy: Never
+      automountServiceAccountToken: false
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: migrate
+          image: REGISTRY/PROJECT/zhinian-aigc:REPLACE_TAG
+          imagePullPolicy: IfNotPresent
+          command: ["node", "scripts/migrate-postgres.mjs"]
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: ZHINIAN_DATA_BACKEND
+              value: postgres
+            # Must match the username in zhinian-web-db/DATABASE_URL.
+            - name: DATABASE_APP_ROLE
+              value: REPLACE_WITH_RDS_APP_ROLE
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: zhinian-migration-db
+                  key: DATABASE_URL
+            - name: DATABASE_SSL_MODE
+              value: verify-full
+            - name: DATABASE_CA_CERT_PATH
+              value: /etc/zhinian/rds/ca.pem
+            - name: DATABASE_CONNECTION_TIMEOUT_MS
+              value: "5000"
+            - name: DATABASE_STATEMENT_TIMEOUT_MS
+              value: "60000"
+          volumeMounts:
+            - name: rds-ca
+              mountPath: /etc/zhinian/rds
+              readOnly: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: rds-ca
+          secret:
+            secretName: zhinian-rds-ca