feat: complete E2E deployment flow with storage layered config and values template versioning

- Instance deployment: charts browser, deploy modal, instances list
- Values Template version management (create/history/rollback)
- Storage layered config (cluster > workspace > shared priority)
- Cluster credential decryptIfNeeded for mixed encrypted/plaintext kubeconfig
- YAML syntax validation (client-side + server-side warning)
- Frontend: charts, instances, storage, templates, admin pages
- Backend: storage service, instance service, cluster service, helm client
- Multi-Tenant Kubeconfig.md: added by user

backend/internal/adapter/input/http/rest/workspace_handler.go

@@ -26,7 +26,7 @@ func NewWorkspaceHandler(workspaceService *service.WorkspaceService, authService
 
 // CreateWorkspace 创建工作空间
 // @Summary 创建工作空间
-// @Description 创建新的工作空间（Admin 专用）
+// @Description 创建新的工作空间（Admin 专用，支持 cluster_ids 和初始配额）
 // @Tags workspace
 // @Accept json
 // @Produce json
@@ -48,7 +48,31 @@ func (h *WorkspaceHandler) CreateWorkspace(w http.ResponseWriter, r *http.Reques
 	// 获取创建者 ID
 	userID := GetUserIDFromRequest(r)
 
-	workspace, err := h.workspaceService.Create(r.Context(), req.Name, req.Description, userID)
+	// 准备配额
+	quotas := make(map[entity.ResourceType]struct {
+		HardLimit float64
+		SoftLimit float64
+	})
+	if req.CPU != nil {
+		quotas[entity.ResourceCPU] = struct {
+			HardLimit float64
+			SoftLimit float64
+		}{req.CPU.HardLimit, req.CPU.SoftLimit}
+	}
+	if req.GPU != nil {
+		quotas[entity.ResourceGPU] = struct {
+			HardLimit float64
+			SoftLimit float64
+		}{req.GPU.HardLimit, req.GPU.SoftLimit}
+	}
+	if req.GPUMemory != nil {
+		quotas[entity.ResourceGPUMemory] = struct {
+			HardLimit float64
+			SoftLimit float64
+		}{req.GPUMemory.HardLimit, req.GPUMemory.SoftLimit}
+	}
+
+	workspace, err := h.workspaceService.Create(r.Context(), req.Name, req.Description, userID, req.ClusterIDs, quotas)
 	if err != nil {
 		respondError(w, http.StatusBadRequest, err.Error(), "")
 		return
@@ -129,6 +153,9 @@ func (h *WorkspaceHandler) UpdateWorkspace(w http.ResponseWriter, r *http.Reques
 	if req.Description != "" {
 		workspace.Description = req.Description
 	}
+	if req.ClusterIDs != nil {
+		workspace.ClusterIDs = req.ClusterIDs
+	}
 
 	if err := h.workspaceService.Update(r.Context(), workspace); err != nil {
 		respondError(w, http.StatusBadRequest, err.Error(), "")