refactor: 前后端目录结构模块化 + v2 优化移植与缺陷修复

前端:
- src/srv/api → src/api，按域分文件夹(auth/cluster/host/storage/deployment/collector)
- 新增 http.ts 引擎(http.get/post/put/delete)，域模块改用语义化调用
- index.html 增加 favicon(匹配应用 logo 的 emerald + Activity 脉冲)

后端分层增强(保留包名):
- 新增 repository/：从 models 拆出 JsonDB 持久化层(InitDB/GetDB/Shutdown/RequestSave)
- 新增 dto/：从 controllers 抽出各域请求契约(带 binding 校验)
- 新增 pkg/crypto、pkg/jwt：从 utils 拆出安全原语(外部 jwt 别名 jwtv5 避免冲突)
- models 只留领域实体 + sanitizer；utils 只留 gin/应用相关(response/errors)

v2 优化移植与缺陷修复:
- 移植密钥分离/SSH TOFU/并发写安全/Loki 生产级配置/Docker 加固
- 修复 deployment.go 并发丢更新、Helm values 重复键、EncryptField 哨兵、loki-gateway 端点等审计缺陷
- 实现真正的优雅关停(main.go http.Server + signal + repository.Shutdown)
- 修复登录契约:后端返回 accessToken，前端 auth.ts/Login.tsx 对齐
- 补 crypto/jwt/repository 单元测试(含并发写回归)

验证: go build/vet/test 全绿；npm run build 通过；登录→鉴权→优雅关停冒烟通过

Co-Authored-By: Claude <noreply@anthropic.com>

docker-entrypoint.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# ============================================================
+# LokiDeploy Secure Entrypoint
+# ============================================================
+# Enforces required secrets at container startup
+# Supports Docker Secrets file-based injection
+# ============================================================
+set -e
+
+# ---- Docker Secrets support ----
+# If *_FILE is provided, read the secret from that file path
+# (Docker Swarm / Docker Compose secrets)
+if [ -n "${JWT_SECRET_FILE:-}" ] && [ -r "$JWT_SECRET_FILE" ]; then
+    JWT_SECRET=$(cat "$JWT_SECRET_FILE")
+    export JWT_SECRET
+fi
+
+if [ -n "${ENCRYPTION_KEY_FILE:-}" ] && [ -r "$ENCRYPTION_KEY_FILE" ]; then
+    ENCRYPTION_KEY=$(cat "$ENCRYPTION_KEY_FILE")
+    export ENCRYPTION_KEY
+fi
+
+# ---- Runtime security validation ----
+MISSING_VARS=()
+
+# P0: JWT_SECRET must be provided at runtime
+if [ -z "${JWT_SECRET:-}" ]; then
+    MISSING_VARS+=("JWT_SECRET")
+fi
+
+# P0: ENCRYPTION_KEY must be provided at runtime for AES credential encryption
+if [ -z "${ENCRYPTION_KEY:-}" ]; then
+    MISSING_VARS+=("ENCRYPTION_KEY")
+fi
+
+if [ ${#MISSING_VARS[@]} -ne 0 ]; then
+    echo "============================================================" >&2
+    echo "FATAL: Missing required security environment variables" >&2
+    echo "============================================================" >&2
+    for var in "${MISSING_VARS[@]}"; do
+        echo "  - $var" >&2
+    done
+    echo "" >&2
+    echo "These MUST be provided at runtime. Examples:" >&2
+    echo "" >&2
+    echo '  docker run -e JWT_SECRET="$(openssl rand -hex 32)" -e ENCRYPTION_KEY="$(openssl rand -hex 32)" lokideploy' >&2
+    echo "" >&2
+    echo "Or via docker-compose secrets (recommended for production):" >&2
+    echo '  secrets:' >&2
+    echo '    - jwt_secret' >&2
+    echo '    - encryption_key' >&2
+    echo '  environment:' >&2
+    echo '    JWT_SECRET_FILE: /run/secrets/jwt_secret' >&2
+    echo '    ENCRYPTION_KEY_FILE: /run/secrets/encryption_key' >&2
+    echo "============================================================" >&2
+    exit 1
+fi
+
+# ---- Validate JWT_SECRET strength ----
+SECRET_LEN=${#JWT_SECRET}
+if [ "$SECRET_LEN" -lt 32 ]; then
+    echo "WARNING: JWT_SECRET should be at least 32 characters long (current: $SECRET_LEN)" >&2
+    echo "  Generate with: openssl rand -hex 32" >&2
+fi
+
+# ---- Validate ENCRYPTION_KEY strength ----
+# config.go 在 ENCRYPTION_KEY < 32 字符时会 log.Fatal 拒绝启动；
+# 此处前置硬校验，避免容器进入"entrypoint 通过但 Go 进程崩溃"的死循环。
+KEY_LEN=${#ENCRYPTION_KEY}
+if [ "$KEY_LEN" -lt 32 ]; then
+    echo "============================================================" >&2
+    echo "FATAL: ENCRYPTION_KEY must be at least 32 characters (current: $KEY_LEN)" >&2
+    echo "  Generate with: openssl rand -hex 32" >&2
+    echo "============================================================" >&2
+    exit 1
+fi
+
+# ---- Signal handling for graceful shutdown ----
+# Forward signals to the application
+shutdown() {
+    echo "Entrypoint received shutdown signal, forwarding to application..."
+    kill -TERM "$child" 2>/dev/null || true
+    wait "$child" 2>/dev/null || true
+    exit 0
+}
+trap shutdown SIGTERM SIGINT
+
+echo "LokiDeploy starting with security configuration OK"
+echo "Data directory: ${DATA_DIR}"
+echo "Server port: ${SERVER_PORT}"
+
+# ---- Start the main application ----
+# Use exec to properly forward signals, but wrap with background + wait
+# so this script's trap handler can intercept signals
+"$@" &
+child=$!
+wait "$child"