fix(ansible): 一主多从从库强制只读

- mysql-instance.cnf.j2 按 mysql_node_role=replica 注入 read-only/super-read-only,
  阻止业务直接写入从库导致主从数据分叉(复制线程与复制管理语句不受影响)
- 账号配置任务在从库上临时放开只读、配置完成后回锁,
  避免 cnf 只读拒绝 ALTER/CREATE USER;主库与 standalone 不受影响

ansible/mysql-deploy.yml

@@ -355,15 +355,27 @@
           EOF
           if ! /usr/bin/mysql --defaults-extra-file="$client_file" -e 'SELECT 1' >/dev/null 2>&1; then
             cat >"$sql_file" <<'EOF'
+          {% if topology == 'primary_replica' and inventory_hostname != mysql_primary_host_value %}
+          SET GLOBAL super_read_only = OFF;
+          SET GLOBAL read_only = OFF;
+          {% endif %}
           ALTER USER 'root'@'localhost' IDENTIFIED BY '{{ mysql_root_password_value | replace("'", "''") }}';
           EOF
             /usr/bin/mysql --protocol=socket --socket={{ mysql_run_dir }}/mysql.sock -uroot <"$sql_file"
           fi
           cat >"$sql_file" <<'EOF'
+          {% if topology == 'primary_replica' and inventory_hostname != mysql_primary_host_value %}
+          SET GLOBAL super_read_only = OFF;
+          SET GLOBAL read_only = OFF;
+          {% endif %}
           CREATE USER IF NOT EXISTS 'root'@'%' IDENTIFIED BY '{{ mysql_root_password_value | replace("'", "''") }}';
           ALTER USER 'root'@'%' IDENTIFIED BY '{{ mysql_root_password_value | replace("'", "''") }}';
           GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
           FLUSH PRIVILEGES;
+          {% if topology == 'primary_replica' and inventory_hostname != mysql_primary_host_value %}
+          SET GLOBAL read_only = ON;
+          SET GLOBAL super_read_only = ON;
+          {% endif %}
           EOF
           /usr/bin/mysql --defaults-extra-file="$client_file" <"$sql_file"
         executable: /bin/bash