feat(distributed): 支持单主控多节点部署和停服迁移

复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。

验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。

cmd/felis/distributed.go

@@ -0,0 +1,44 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"felis.lolicon.best/internal/archivetransfer"
+	"felis.lolicon.best/internal/config"
+	"felis.lolicon.best/internal/distributed"
+	"felis.lolicon.best/internal/placement"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+func distributionManager(cl client.Client, cfg *config.Config, image string) (*distributed.Manager, error) {
+	if os.Getenv("FELIS_DISTRIBUTED") != "true" {
+		return nil, nil
+	}
+	controller, url, key := os.Getenv("FELIS_CONTROLLER_NODE"), os.Getenv("FELIS_ARCHIVE_URL"), os.Getenv(archivetransfer.KeyEnv)
+	if controller == "" || url == "" || len(key) < 32 || image == "" || cfg.Archive.Store != "tarLocal" {
+		return nil, fmt.Errorf("distributed mode requires controller identity, archive service/key, Felis image and tarLocal")
+	}
+	return &distributed.Manager{Client: cl, Namespace: cfg.K8s.Namespace, Image: image, Controller: controller, Archive: archivetransfer.Client{URL: url, Root: cfg.Archive.LocalPath, Key: key}, Resolve: placement.Resolve(cl, cfg.K8s.Namespace, controller)}, nil
+}
+
+func reconcileDistribution(ctx context.Context, m *distributed.Manager, stderr io.Writer) {
+	ticker := time.NewTicker(3 * time.Second)
+	defer ticker.Stop()
+	for {
+		if err := m.SettleBackups(ctx); err != nil {
+			fmt.Fprintln(stderr, "distributed backup:", err)
+		}
+		if err := m.ReconcileMigrations(ctx); err != nil {
+			fmt.Fprintln(stderr, "migration:", err)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}