refactor: full-stack restructure with multi-tenancy, workspace management, and K8s diagnostics

- Add Workspace domain (entity, repository, service, handler, DTO)
- Add multi-tenant K8s client with tenant binding and quota management
- Add K8s diagnostics client (instance diagnostics)
- Add authorization middleware (authz package)
- Restructure frontend to feature-based architecture (features/)
- Add User Management page in configuration
- Add AccessDenied page and route guards
- Refactor shared components (form inputs, layout, UI)
- Update Tailwind config for new design system
- Add comprehensive documentation (docs/, tasks/, plans)
- Improve cluster service with better kubeconfig handling
- Add tests for crypto, config, helm client, tenant binding

backend/internal/domain/repository/cluster_repository.go

@@ -9,20 +9,19 @@ import (
 type ClusterRepository interface {
 	// Create 创建集群
 	Create(ctx context.Context, cluster *entity.Cluster) error
-	
+
 	// GetByID 根据 ID 获取集群
 	GetByID(ctx context.Context, id string) (*entity.Cluster, error)
-	
+
 	// GetByName 根据名称获取集群
 	GetByName(ctx context.Context, name string) (*entity.Cluster, error)
-	
+
 	// Update 更新集群
 	Update(ctx context.Context, cluster *entity.Cluster) error
-	
+
 	// Delete 删除集群
 	Delete(ctx context.Context, id string) error
-	
+
 	// List 列出所有集群
 	List(ctx context.Context) ([]*entity.Cluster, error)
 }
-

backend/internal/domain/repository/helm_client.go

@@ -9,26 +9,25 @@ import (
 type HelmClient interface {
 	// Install 安装 Helm Chart
 	Install(ctx context.Context, cluster *entity.Cluster, instance *entity.Instance) error
-	
+
 	// Upgrade 升级 Helm Release
 	Upgrade(ctx context.Context, cluster *entity.Cluster, instance *entity.Instance) error
-	
+
 	// Uninstall 卸载 Helm Release
 	Uninstall(ctx context.Context, cluster *entity.Cluster, releaseName, namespace string) error
-	
+
 	// Rollback 回滚 Helm Release
 	Rollback(ctx context.Context, cluster *entity.Cluster, releaseName, namespace string, revision int) error
-	
+
 	// GetStatus 获取 Release 状态
 	GetStatus(ctx context.Context, cluster *entity.Cluster, releaseName, namespace string) (*entity.Instance, error)
-	
+
 	// GetHistory 获取 Release 历史
 	GetHistory(ctx context.Context, cluster *entity.Cluster, releaseName, namespace string) ([]*entity.ReleaseHistory, error)
-	
+
 	// List 列出集群中的所有 Releases
 	List(ctx context.Context, cluster *entity.Cluster, namespace string) ([]*entity.Instance, error)
-	
+
 	// GetValues 获取 Release 的 values
 	GetValues(ctx context.Context, cluster *entity.Cluster, releaseName, namespace string) (map[string]interface{}, error)
 }
-

backend/internal/domain/repository/instance_diagnostics_client.go

@@ -0,0 +1,11 @@
+package repository
+
+import (
+	"context"
+
+	"github.com/ocdp/cluster-service/internal/domain/entity"
+)
+
+type InstanceDiagnosticsClient interface {
+	GetDiagnostics(ctx context.Context, cluster *entity.Cluster, instance *entity.Instance, tailLines int64) (*entity.InstanceDiagnostics, error)
+}

backend/internal/domain/repository/instance_repository.go

@@ -9,23 +9,22 @@ import (
 type InstanceRepository interface {
 	// Create 创建实例
 	Create(ctx context.Context, instance *entity.Instance) error
-	
+
 	// GetByID 根据 ID 获取实例
 	GetByID(ctx context.Context, id string) (*entity.Instance, error)
-	
+
 	// GetByClusterAndName 根据集群 ID 和名称获取实例
 	GetByClusterAndName(ctx context.Context, clusterID, name string) (*entity.Instance, error)
-	
+
 	// Update 更新实例
 	Update(ctx context.Context, instance *entity.Instance) error
-	
+
 	// Delete 删除实例
 	Delete(ctx context.Context, id string) error
-	
+
 	// ListByCluster 列出指定集群的所有实例
 	ListByCluster(ctx context.Context, clusterID string) ([]*entity.Instance, error)
-	
+
 	// List 列出所有实例
 	List(ctx context.Context) ([]*entity.Instance, error)
 }
-

backend/internal/domain/repository/metrics_client.go

@@ -10,8 +10,7 @@ import (
 type MetricsClient interface {
 	// GetClusterMetrics 获取集群的监控指标
 	GetClusterMetrics(ctx context.Context, clusterID string) (*entity.ClusterMetrics, error)
-	
+
 	// GetNodeMetrics 获取集群的节点指标
 	GetNodeMetrics(ctx context.Context, clusterID string) ([]*entity.NodeMetrics, error)
 }
-

backend/internal/domain/repository/oci_client.go

@@ -7,26 +7,29 @@ import (
 
 // OCIClient OCI Registry 客户端接口（Output Port）
 type OCIClient interface {
-	// ListRepositories 列出 Registry 中的所有 repositories
-	ListRepositories(ctx context.Context, registry *entity.Registry) ([]string, error)
-	
+	// ListRepositories 列出 Registry 中的 repositories.
+	// artifactType 支持 "chart" 和 "all"，默认由调用方决定。
+	ListRepositories(ctx context.Context, registry *entity.Registry, artifactType string) ([]string, error)
+
 	// ListArtifacts 列出指定 repository 的所有 artifacts
 	// mediaTypeFilter: "all", "image", "chart", "other" - 使用模糊匹配过滤
 	ListArtifacts(ctx context.Context, registry *entity.Registry, repository, mediaTypeFilter string) ([]*entity.Artifact, error)
-	
+
 	// GetArtifact 获取指定 artifact 的详细信息
 	GetArtifact(ctx context.Context, registry *entity.Registry, repository, reference string) (*entity.Artifact, error)
-	
+
 	// GetValuesSchema 获取 Helm Chart 的 values schema
 	GetValuesSchema(ctx context.Context, registry *entity.Registry, repository, reference string) (string, error)
-	
+
+	// GetValuesYAML 获取 Helm Chart 原始 values.yaml
+	GetValuesYAML(ctx context.Context, registry *entity.Registry, repository, reference string) (string, error)
+
 	// PullArtifact 下载 artifact 到本地
 	PullArtifact(ctx context.Context, registry *entity.Registry, repository, reference, destPath string) error
-	
+
 	// PushArtifact 推送 artifact 到 Registry
 	PushArtifact(ctx context.Context, registry *entity.Registry, repository, tag, sourcePath string) error
-	
+
 	// CheckHealth 检查 Registry 健康状态
 	CheckHealth(ctx context.Context, registry *entity.Registry) error
 }
-

backend/internal/domain/repository/registry_repository.go

@@ -9,20 +9,19 @@ import (
 type RegistryRepository interface {
 	// Create 创建 Registry
 	Create(ctx context.Context, registry *entity.Registry) error
-	
+
 	// GetByID 根据 ID 获取 Registry
 	GetByID(ctx context.Context, id string) (*entity.Registry, error)
-	
+
 	// GetByName 根据名称获取 Registry
 	GetByName(ctx context.Context, name string) (*entity.Registry, error)
-	
+
 	// Update 更新 Registry
 	Update(ctx context.Context, registry *entity.Registry) error
-	
+
 	// Delete 删除 Registry
 	Delete(ctx context.Context, id string) error
-	
+
 	// List 列出所有 Registries
 	List(ctx context.Context) ([]*entity.Registry, error)
 }
-

backend/internal/domain/repository/tenant_kube_client.go

@@ -0,0 +1,15 @@
+package repository
+
+import (
+	"context"
+	"time"
+
+	"github.com/ocdp/cluster-service/internal/domain/entity"
+)
+
+// TenantKubeClient provisions namespace-scoped Kubernetes access for tenants.
+type TenantKubeClient interface {
+	EnsureTenant(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding) error
+	IssueKubeconfig(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding, ttl time.Duration) (*entity.TenantKubeconfig, error)
+	SuspendTenant(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding) error
+}

backend/internal/domain/repository/user_repository.go

@@ -9,20 +9,19 @@ import (
 type UserRepository interface {
 	// Create 创建用户
 	Create(ctx context.Context, user *entity.User) error
-	
+
 	// GetByID 根据 ID 获取用户
 	GetByID(ctx context.Context, id string) (*entity.User, error)
-	
+
 	// GetByUsername 根据用户名获取用户
 	GetByUsername(ctx context.Context, username string) (*entity.User, error)
-	
+
 	// Update 更新用户
 	Update(ctx context.Context, user *entity.User) error
-	
+
 	// Delete 删除用户
 	Delete(ctx context.Context, id string) error
-	
+
 	// List 列出所有用户
 	List(ctx context.Context) ([]*entity.User, error)
 }
-

backend/internal/domain/repository/workspace_repository.go

@@ -0,0 +1,26 @@
+package repository
+
+import (
+	"context"
+
+	"github.com/ocdp/cluster-service/internal/domain/entity"
+)
+
+type WorkspaceRepository interface {
+	Create(ctx context.Context, workspace *entity.Workspace) error
+	GetByID(ctx context.Context, id string) (*entity.Workspace, error)
+	GetByName(ctx context.Context, name string) (*entity.Workspace, error)
+	Update(ctx context.Context, workspace *entity.Workspace) error
+	List(ctx context.Context) ([]*entity.Workspace, error)
+}
+
+type WorkspaceClusterBindingRepository interface {
+	Upsert(ctx context.Context, binding *entity.WorkspaceClusterBinding) error
+	Get(ctx context.Context, workspaceID, clusterID string) (*entity.WorkspaceClusterBinding, error)
+	Delete(ctx context.Context, workspaceID, clusterID string) error
+}
+
+type AuditLogRepository interface {
+	Create(ctx context.Context, log *entity.AuditLog) error
+	ListByWorkspace(ctx context.Context, workspaceID string, limit int) ([]*entity.AuditLog, error)
+}