feat: 去 mock 化 —— 全模块接入真实数据 (参考 jianmu/opsx-jenkins/aiops)

后端（35+ 新路由）：
- AES-256-GCM 字段加密(enc:v1:)，密钥自动生成 data/encryption.key
- 新模型：Host/K8sCluster/Credential/BuildNode/DeployTool/WebhookEndpoint/
  JenkinsServer/SystemSetting；Pipeline 扩展触发器/变量/缓存列，
  PipelineRun 扩展 buildNumber/externalUrl
- 资源 CRUD + 真实测试端点：主机/集群/构建节点 TCP 拨号、
  工具真实执行版本检测(保守安装策略)、Webhook HMAC-SHA256 签名发送、
  入站流水线触发 /api/hooks/pipeline/:id
- Jenkins 完整集成（移植 opsx-jenkins 生产客户端）：crumb/BasicAuth/
  buildWithParameters/Location 队列/progressiveText 增量控制台，
  服务器 CRUD+测试、Job 树拉取(folder 压平)、导入为流水线、
  jenkins 类型流水线真实执行回传日志
- 流水线列表附带 lastRun、运行重试、summary 统计、系统设置单行表
- 运行结束触发出站 Webhook 通知；GitOps 同步状态真实推进

前端（14 页全部去 mock）：
- 流水线列表/发布记录/批量发布/环境/凭证/构建节点/工具/Webhook/
  系统设置/Jenkins 导入/GitOps(资源树+差异) 全部接入真实 API
- 编辑器 4 Tab 持久化（基本信息/触发设置含真实 Webhook URL/变量缓存/发布历史）
- TopBar 真实流水线切换 + 仅保存/保存并运行
- Sidebar 徽标真实统计；删除未使用组件与 mock 数据文件

backend/internal/handler/pipelines.go

@@ -10,15 +10,38 @@ import (
 	"flowstack/internal/model"
 )
 
-// ListPipelines GET /api/pipelines
+// ListPipelines GET /api/pipelines —— 附带每条流水线最近一次运行信息
 func ListPipelines(c *gin.Context) {
 	var list []model.Pipeline
 	database.DB.Order("updated_at DESC").Find(&list)
-	c.JSON(http.StatusOK, list)
+
+	// 每流水线最近一次 run（一次查询取全表后内存分组，数据量小；jianmu 用反规范化表，此处无需）
+	var runs []model.PipelineRun
+	database.DB.Order("started_at DESC").Limit(500).Find(&runs)
+	lastByPipeline := make(map[uint]model.PipelineRun)
+	for _, r := range runs {
+		if _, ok := lastByPipeline[r.PipelineID]; !ok {
+			lastByPipeline[r.PipelineID] = r
+		}
+	}
+
+	type pipelineWithLastRun struct {
+		model.Pipeline
+		LastRun *model.PipelineRun `json:"lastRun"`
+	}
+	result := make([]pipelineWithLastRun, 0, len(list))
+	for _, p := range list {
+		item := pipelineWithLastRun{Pipeline: p}
+		if r, ok := lastByPipeline[p.ID]; ok {
+			item.LastRun = &r
+		}
+		result = append(result, item)
+	}
+	c.JSON(http.StatusOK, result)
 }
 
-// GetPipeline GET /api/pipelines/:id —— 详情含画布节点与连线
-func GetPipeline(c *gin.Context) {
+// GetPipelineDetail GET /api/pipelines/:id —— 完整详情（编辑器各 Tab 数据源）
+func GetPipelineDetail(c *gin.Context) {
 	var p model.Pipeline
 	if err := database.DB.First(&p, c.Param("id")).Error; err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "pipeline not found"})
@@ -28,16 +51,73 @@ func GetPipeline(c *gin.Context) {
 	database.DB.Where("pipeline_id = ?", p.ID).Order("position_x").Find(&nodes)
 	var edges []model.PipelineEdge
 	database.DB.Where("pipeline_id = ?", p.ID).Find(&edges)
+	var lastRun model.PipelineRun
+	hasRun := database.DB.Where("pipeline_id = ?", p.ID).Order("started_at DESC").First(&lastRun).Error == nil
 	c.JSON(http.StatusOK, gin.H{
 		"pipeline": p, "nodes": nodes, "edges": edges,
-		"name": p.Name, "description": p.Description, "type": p.Type,
-		"sourceRepo": p.SourceRepo, "sourceBranch": p.SourceBranch,
-		"gitopsRepo": p.GitopsRepo, "gitopsPath": p.GitopsPath,
-		"deployType": p.DeployType, "env": p.Env,
-		"id": p.ID, "createdAt": p.CreatedAt, "updatedAt": p.UpdatedAt,
+		"lastRun": func() *model.PipelineRun {
+			if hasRun {
+				return &lastRun
+			}
+			return nil
+		}(),
 	})
 }
 
+// GetSummary GET /api/summary —— 侧边栏徽标与首页统计
+func GetSummary(c *gin.Context) {
+	var buildNodes, plugins, running, pipelines, hosts, clusters int64
+	database.DB.Model(&model.BuildNode{}).Count(&buildNodes)
+	database.DB.Model(&model.Plugin{}).Count(&plugins)
+	database.DB.Model(&model.PipelineRun{}).Where("status IN ('pending','queued','running')").Count(&running)
+	database.DB.Model(&model.Pipeline{}).Count(&pipelines)
+	database.DB.Model(&model.Host{}).Count(&hosts)
+	database.DB.Model(&model.K8sCluster{}).Count(&clusters)
+	c.JSON(http.StatusOK, gin.H{
+		"buildNodes": buildNodes, "plugins": plugins, "running": running,
+		"pipelines": pipelines, "hosts": hosts, "clusters": clusters,
+	})
+}
+
+// GetSettings GET /api/settings —— 单行设置
+func GetSettings(c *gin.Context) {
+	var s model.SystemSetting
+	if err := database.DB.First(&s, 1).Error; err != nil {
+		s = model.SystemSetting{ID: 1}
+		database.DB.Create(&s)
+	}
+	c.JSON(http.StatusOK, s)
+}
+
+// UpdateSettings PUT /api/settings
+func UpdateSettings(c *gin.Context) {
+	var s model.SystemSetting
+	if err := database.DB.First(&s, 1).Error; err != nil {
+		s = model.SystemSetting{ID: 1}
+		database.DB.Create(&s)
+	}
+	var body map[string]any
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	updates := map[string]any{"updated_at": time.Now()}
+	if v, ok := body["theme"].(string); ok {
+		updates["theme"] = v
+	}
+	if v, ok := body["notification"].(string); ok {
+		updates["notification"] = v
+	}
+	if v, ok := body["toolMode"].(string); ok {
+		updates["tool_mode"] = v
+	}
+	if v, ok := body["extra"].(string); ok {
+		updates["extra"] = v
+	}
+	database.DB.Model(&s).Updates(updates)
+	c.JSON(http.StatusOK, s)
+}
+
 // CreatePipeline POST /api/pipelines
 func CreatePipeline(c *gin.Context) {
 	var input struct {
@@ -82,7 +162,12 @@ func UpdatePipeline(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-	allowed := map[string]bool{"name": true, "description": true, "sourceRepo": true, "sourceBranch": true, "gitopsRepo": true, "gitopsPath": true, "deployType": true, "env": true}
+	allowed := map[string]bool{
+		"name": true, "description": true, "sourceRepo": true, "sourceBranch": true,
+		"gitopsRepo": true, "gitopsPath": true, "deployType": true, "env": true,
+		"triggerMode": true, "cronExpr": true, "webhookToken": true, "watchBranches": true,
+		"variables": true, "cachePaths": true, "notifyWebhookURL": true, "jenkinsJobName": true,
+	}
 	updates := map[string]any{}
 	for k, v := range input {
 		if allowed[k] {