refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复

前端:
- src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector)
- 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用
- index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲)

后端分层增强(保留包名):
- 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave)
- 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验)
- 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突)
- models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors)

v2 优化移植与缺陷修复:
- 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固
- 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷
- 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown)
- 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐
- 补 crypto/jwt/repository 单元测试(含并发写回归)

验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过

Co-Authored-By: Claude <noreply@anthropic.com>

backend/services/host.go

@@ -2,10 +2,13 @@ package services
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"time"
 
 	"lokideploy/models"
+	"lokideploy/pkg/crypto"
+	"lokideploy/repository"
 	"lokideploy/utils"
 )
 
@@ -20,7 +23,7 @@ func (s *HostService) Create(name, hostIP string, port int, user, authType, pass
 		port = 22
 	}
 	host := models.Host{
-		ID:        models.GetDB().NextID("hosts"),
+		ID:        repository.GetDB().NextID("hosts"),
 		Name:      name,
 		HostIP:    hostIP,
 		Port:      port,
@@ -34,30 +37,39 @@ func (s *HostService) Create(name, hostIP string, port int, user, authType, pass
 		UpdatedAt: time.Now(),
 	}
 	if password != "" {
-		enc, _ := utils.Encrypt(password)
-		host.Password = "ENC:" + enc
+		enc, err := crypto.EncryptField(password)
+		if err != nil {
+			return nil, fmt.Errorf("密码加密失败: %w", err)
+		}
+		host.Password = enc
 	}
 	if privateKey != "" {
-		enc, _ := utils.Encrypt(privateKey)
-		host.PrivateKey = "ENC:" + enc
+		enc, err := crypto.EncryptField(privateKey)
+		if err != nil {
+			return nil, fmt.Errorf("私钥加密失败: %w", err)
+		}
+		host.PrivateKey = enc
 	}
 	if keyPhrase != "" {
-		enc, _ := utils.Encrypt(keyPhrase)
-		host.KeyPhrase = "ENC:" + enc
+		enc, err := crypto.EncryptField(keyPhrase)
+		if err != nil {
+			return nil, fmt.Errorf("私钥口令加密失败: %w", err)
+		}
+		host.KeyPhrase = enc
 	}
 
-	db := models.GetDB()
+	db := repository.GetDB()
 	db.Lock()
 	db.Hosts = append(db.Hosts, host)
 	db.Unlock()
-	go db.Save()
+	db.RequestSave()
 
 	go s.Validate(host.ID)
 	return &host, nil
 }
 
 func (s *HostService) Get(id uint) (*models.Host, error) {
-	db := models.GetDB()
+	db := repository.GetDB()
 	db.RLock()
 	defer db.RUnlock()
 	for i := range db.Hosts {
@@ -70,7 +82,7 @@ func (s *HostService) Get(id uint) (*models.Host, error) {
 }
 
 func (s *HostService) List(page, pageSize int) ([]models.Host, int64, error) {
-	db := models.GetDB()
+	db := repository.GetDB()
 	db.RLock()
 	defer db.RUnlock()
 
@@ -89,7 +101,7 @@ func (s *HostService) List(page, pageSize int) ([]models.Host, int64, error) {
 }
 
 func (s *HostService) Update(id uint, updates map[string]interface{}) error {
-	db := models.GetDB()
+	db := repository.GetDB()
 	db.Lock()
 	defer db.Unlock()
 	for i := range db.Hosts {
@@ -107,7 +119,7 @@ func (s *HostService) Update(id uint, updates map[string]interface{}) error {
 				db.Hosts[i].Arch = v
 			}
 			db.Hosts[i].UpdatedAt = time.Now()
-			go db.Save()
+			db.RequestSave()
 			return nil
 		}
 	}
@@ -115,13 +127,13 @@ func (s *HostService) Update(id uint, updates map[string]interface{}) error {
 }
 
 func (s *HostService) Delete(id uint) error {
-	db := models.GetDB()
+	db := repository.GetDB()
 	db.Lock()
 	defer db.Unlock()
 	for i, h := range db.Hosts {
 		if h.ID == id {
 			db.Hosts = append(db.Hosts[:i], db.Hosts[i+1:]...)
-			go db.Save()
+			db.RequestSave()
 			return nil
 		}
 	}
@@ -138,7 +150,7 @@ func (s *HostService) Validate(id uint) {
 
 	password := host.Password
 	if strings.HasPrefix(password, "ENC:") {
-		password, _ = utils.Decrypt(password[4:])
+		password, _ = crypto.Decrypt(password[4:])
 	}
 
 	client, err := NewSSHClient(host.HostIP, host.Port, host.User, password)
@@ -165,7 +177,7 @@ func (s *HostService) ExecuteCommand(id uint, command string) (string, string, e
 
 	password := host.Password
 	if strings.HasPrefix(password, "ENC:") {
-		password, _ = utils.Decrypt(password[4:])
+		password, _ = crypto.Decrypt(password[4:])
 	}
 
 	client, err := NewSSHClient(host.HostIP, host.Port, host.User, password)