refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复

前端:
- src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector)
- 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用
- index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲)

后端分层增强(保留包名):
- 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave)
- 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验)
- 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突)
- models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors)

v2 优化移植与缺陷修复:
- 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固
- 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷
- 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown)
- 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐
- 补 crypto/jwt/repository 单元测试(含并发写回归)

验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过

Co-Authored-By: Claude <noreply@anthropic.com>

backend/config/config.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"sync"
@@ -12,24 +14,49 @@ var (
 )
 
 type Config struct {
-	ServerPort   string
-	DatabasePath string
-	JWTSecret    string
-	DataDir      string
-	KubeDir      string
+	ServerPort    string
+	DatabasePath  string
+	JWTSecret     string
+	EncryptionKey string // 独立加密密钥，必须与JWT_SECRET分离
+	DataDir       string
+	KubeDir       string
+	LogLevel      string // 新增：日志级别 debug/info/warn/error
+	HostKeyDir    string // 新增：SSH主机密钥存储目录
 }
 
 func GetConfig() *Config {
 	once.Do(func() {
 		dataDir := getEnv("DATA_DIR", "./data")
-		instance = &Config{
-			ServerPort:   getEnv("SERVER_PORT", "8080"),
-			DatabasePath: filepath.Join(dataDir, "lokideploy.json"),
-			JWTSecret:    getEnv("JWT_SECRET", "lokideploy-secret-key-change-in-production"),
-			DataDir:      dataDir,
-			KubeDir:      filepath.Join(dataDir, "kubeconfigs"),
+
+		jwtSecret := os.Getenv("JWT_SECRET")
+		encKey := os.Getenv("ENCRYPTION_KEY")
+
+		// 生产环境强制校验：JWT_SECRET和ENCRYPTION_KEY必须设置
+		if jwtSecret == "" {
+			log.Fatal("[SECURITY] JWT_SECRET environment variable is required. Please set a strong random secret.")
 		}
-		_ = os.MkdirAll(instance.KubeDir, 0755)
+		if encKey == "" {
+			log.Fatal("[SECURITY] ENCRYPTION_KEY environment variable is required. Please set a strong 32-byte random key (base64 or hex encoded).")
+		}
+
+		// ENCRYPTION_KEY 长度校验：至少32字节（256位）
+		if len(encKey) < 32 {
+			log.Fatal(fmt.Sprintf("[SECURITY] ENCRYPTION_KEY must be at least 32 bytes, got %d bytes", len(encKey)))
+		}
+
+		instance = &Config{
+			ServerPort:    getEnv("SERVER_PORT", "8080"),
+			DatabasePath:  filepath.Join(dataDir, "lokideploy.json"),
+			JWTSecret:     jwtSecret,
+			EncryptionKey: encKey,
+			DataDir:       dataDir,
+			KubeDir:       filepath.Join(dataDir, "kubeconfigs"),
+			LogLevel:      getEnv("LOG_LEVEL", "info"),
+			HostKeyDir:    filepath.Join(dataDir, "known_hosts"),
+		}
+
+		_ = os.MkdirAll(instance.KubeDir, 0700)
+		_ = os.MkdirAll(instance.HostKeyDir, 0700)
 	})
 	return instance
 }