feat(backend): unified response helpers, refresh token, security hardening

- new resp package (OK/Page/Fail/BadRequest/.../InternalErr): unified error
  envelope {detail, code?}, sanitized 500s (full error logged server-side,
  generic message to client - stops DB error leakage), pagination envelope
  {items,total,page,page_size}; migrate 200+ inline c.JSON error sites
- refresh token: 7d rotation tokens (SHA-256 hashed at rest), public
  POST /auth/refresh with single-use rotation, POST /auth/logout revokes
  all user refresh tokens (endpoint previously missing - frontend 404)
- security: gh-ost command line password masked in task status payload;
  Instance.MarshalJSON guarantees encrypted passwords never leave the API
  (removes reliance on per-handler manual masking); production (DEBUG=false)
  with default JWT secret now auto-generates and persists a random secret
- safe.Go recover wrapper for background goroutines (instance probe,
  gh-ost async)
- delete dead service layer (zero callers)
- fix pre-existing go vet unkeyed bson.E literals

backend/cmd/server/main.go

@@ -58,11 +58,15 @@ func main() {
 		&model.ScheduledTask{},
 		&model.ScheduledTaskLog{},
 		&model.UserGroup{},
+		&model.RefreshToken{},
 	)
 
 	// Seed default data (idempotent): users, workflow, settings
 	seedAll(db)
 
+	// 治理默认 JWT 密钥（生产模式自动生成并持久化）
+	config.EnsureJWTSecret()
+
 	// Setup Gin
 	r := gin.Default()
 	r.Use(middleware.CORSMiddleware())