feat(distributed): 支持单主控多节点部署和停服迁移

复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。

验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。

internal/api/handlers_user.go

@@ -406,6 +406,7 @@ type fleetServerView struct {
 // value and decodeJSON rejects unknown fields, so a caller can never smuggle
 // free-form YAML or raw CRD fields through this endpoint.
 type createServerRequest struct {
+	NodeName        string           `json:"nodeName,omitempty"`
 	Name            string           `json:"name"`
 	Subdomain       string           `json:"subdomain"`
 	DisplayName     string           `json:"displayName,omitempty"`
@@ -445,6 +446,15 @@ func (a *API) handleCreateServer(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if a.Distribution != nil {
+		if err := a.Distribution.ValidateNode(r.Context(), body.NodeName); err != nil {
+			writeError(w, r, newError(400, "bad_node", "select an approved worker: %v", err))
+			return
+		}
+	} else if body.NodeName != "" {
+		writeError(w, r, newError(400, "bad_node", "node selection requires distributed deployment"))
+		return
+	}
 	// Server name and subdomain both obey the §22 portability rule and the
 	// reservation list.
 	if err := naming.ValidateServerName(body.Name); err != nil {
@@ -572,6 +582,7 @@ func (a *API) handleCreateServer(w http.ResponseWriter, r *http.Request) {
 	}
 
 	in := CreateServerInput{
+		NodeName:        body.NodeName,
 		Name:            body.Name,
 		Subdomain:       body.Subdomain,
 		DisplayName:     displayName,