feat(provision): 弹性节点基建 Terraform + 一键更换 (tsk_6u0FxmbC7Yeq)

IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4
「节点是牲口」弹性拓扑与 make-before-break 一键更换。

server/internal/provision:
- CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）；
  厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。
- ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、
  RotateIP(换 IP 不换机 + version bump)、ListProviders。
- Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降），
  replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。
- RotatePool：池内滚动轮换，并发度 1–2。
- cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。
- 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、
  开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。

infra/:
- terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README，
  低频基线进 state，节点不进 Terraform。
- cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。
- identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。

migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events
增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。

红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/provision/providers/vultr.go

@@ -0,0 +1,110 @@
+package providers
+
+import (
+	"context"
+	"encoding/base64"
+	"os"
+
+	"github.com/wangjia/pangolin/server/internal/provision"
+)
+
+// vultrAdapter implements provision.CloudAdapter against the Vultr API v2.
+// Consumable pool: cheap, hourly-billed, reserved-IP capable.
+//
+// Credentials: PROVISION_VULTR_API_KEY (env, independent secret).
+// Default OS image: PROVISION_VULTR_OS_ID (defaults to a current Debian image).
+type vultrAdapter struct {
+	c    *httpClient
+	osID int
+}
+
+func newVultrFromEnv() (provision.CloudAdapter, error) {
+	key, err := secret("PROVISION_VULTR_API_KEY")
+	if err != nil {
+		return nil, err
+	}
+	osID := atoiDefault(os.Getenv("PROVISION_VULTR_OS_ID"), 2136) // 2136 = Debian 12 x64
+	return &vultrAdapter{
+		c:    newHTTPClient("https://api.vultr.com/v2", key),
+		osID: osID,
+	}, nil
+}
+
+func (a *vultrAdapter) Kind() string            { return "vultr" }
+func (a *vultrAdapter) SupportsElasticIP() bool { return true } // reserved IPs
+
+func (a *vultrAdapter) CreateInstance(ctx context.Context, in provision.CreateInput) (*provision.Instance, error) {
+	body := map[string]any{
+		"region":    in.Region,
+		"plan":      in.Plan,
+		"os_id":     a.osID,
+		"label":     in.Label,
+		"hostname":  in.Label,
+		"user_data": base64.StdEncoding.EncodeToString([]byte(in.UserData)),
+		"tags":      in.Tags,
+		"backups":   "disabled",
+	}
+	if len(in.SSHKeyIDs) > 0 {
+		body["sshkey_id"] = in.SSHKeyIDs
+	}
+	var resp struct {
+		Instance struct {
+			ID     string `json:"id"`
+			MainIP string `json:"main_ip"`
+			Region string `json:"region"`
+		} `json:"instance"`
+	}
+	if err := a.c.do(ctx, "POST", "/instances", body, &resp); err != nil {
+		return nil, err
+	}
+	return &provision.Instance{
+		ID:     resp.Instance.ID,
+		IP:     resp.Instance.MainIP,
+		Region: resp.Instance.Region,
+	}, nil
+}
+
+func (a *vultrAdapter) DestroyInstance(ctx context.Context, instanceID string) error {
+	err := a.c.do(ctx, "DELETE", "/instances/"+instanceID, nil, nil)
+	if err != nil && isNotFound(err) {
+		return nil // idempotent: already gone
+	}
+	return err
+}
+
+func (a *vultrAdapter) AttachIP(ctx context.Context, instanceID string) (string, error) {
+	// Allocate a reserved IPv4, then attach it to the instance.
+	var created struct {
+		ReservedIP struct {
+			ID     string `json:"id"`
+			Subnet string `json:"subnet"`
+		} `json:"reserved_ip"`
+	}
+	if err := a.c.do(ctx, "POST", "/reserved-ips", map[string]any{
+		"region":      "",
+		"ip_type":     "v4",
+		"label":       "rotate-" + instanceID,
+		"instance_id": instanceID,
+	}, &created); err != nil {
+		return "", err
+	}
+	return created.ReservedIP.Subnet, nil
+}
+
+func (a *vultrAdapter) ListRegions(ctx context.Context) ([]provision.Region, error) {
+	var resp struct {
+		Regions []struct {
+			ID      string `json:"id"`
+			Country string `json:"country"`
+			City    string `json:"city"`
+		} `json:"regions"`
+	}
+	if err := a.c.do(ctx, "GET", "/regions", nil, &resp); err != nil {
+		return nil, err
+	}
+	out := make([]provision.Region, 0, len(resp.Regions))
+	for _, r := range resp.Regions {
+		out = append(out, provision.Region{ID: r.ID, Country: r.Country, City: r.City})
+	}
+	return out, nil
+}