feat: add direct PostgreSQL and ACK deployment support

deploy/ack/web.yaml

@@ -0,0 +1,95 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zhinian-web
+  namespace: zhinian
+spec:
+  # Keep one replica until uploaded/generated files are stored in OSS or another
+  # shared object store. PostgreSQL alone does not make local runtime files shared.
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1 # Budget RDS connections for (replicas + maxSurge) * DATABASE_POOL_MAX.
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: zhinian
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: zhinian
+        app.kubernetes.io/component: web
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: web
+          image: REGISTRY/PROJECT/zhinian-aigc:REPLACE_TAG
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 3000
+          envFrom:
+            - configMapRef:
+                name: zhinian-runtime
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: zhinian-web-db
+                  key: DATABASE_URL
+            - name: ZHINIAN_INTERNAL_WORKER_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: zhinian-worker-auth
+                  key: ZHINIAN_INTERNAL_WORKER_TOKEN
+            - name: ZHINIAN_AUTH_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: zhinian-web-auth
+                  key: ZHINIAN_AUTH_SESSION_SECRET
+          volumeMounts:
+            - name: rds-ca
+              mountPath: /etc/zhinian/rds
+              readOnly: true
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 5
+            failureThreshold: 24
+          readinessProbe:
+            httpGet:
+              path: /api/ready
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            periodSeconds: 20
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            # The current image runs as root. Add a fixed non-root image user and
+            # verify /app/.runtime permissions before enabling runAsNonRoot.
+      volumes:
+        - name: rds-ca
+          secret:
+            secretName: zhinian-rds-ca