fix: 全维度审查修复（安全/正确性/性能/稳定性/客户端/前端）

安全
- /api/ziniao/** 五个匿名接口加管理员鉴权（此前可匿名换取任意员工店铺登录令牌）
- 删除 Flask 遗留后门：默认密码建超管 + 每次启动写生产 users 表（服务端与客户端各一份）
- 进度/详情接口归属过滤：新增 TaskProgressOwnershipSupport，11 模块 progress/light 与
  /tasks/batch 接入，DTO 补 userId，前端 13 个查询封装补传（未传时后端不过滤，兼容旧端）
- 代理提取链接（含账密）不再明文入日志（新增 common/util/SecretMasking）
- 全局异常兜底不再回传原始异常信息；内部令牌比较改常量时间
- 登录加失败计数与锁定（10 次锁 15 分钟）；品牌源文件下载加 SSRF 防护
- AdminApiGuardFilter 覆盖前缀从 2 扩到 15（开关默认 false，行为不变，为收紧做准备）
- 生产关闭 springdoc/knife4j（/doc.html 匿名可读全部接口定义）

正确性
- 40901/40902 拆分：锁竞争不再被伪装成 success=true（此前客户端停止重试、分片静默丢失）
- 假成功收敛：集采明细批量写失败改为抛出、去重 worker 异常标失败、4 个 worker 改判
  success 字段、publish 空 ASIN 行参与批次 flush、巡店删除全失败带 error 上报
- 客户端心跳 discard 移入 finally（7 模块，失败路径不再留僵尸 RUNNING 任务）
- 状态机条件更新：跟价停止循环、集采 activate/fail、imagevideo 归档回填、店铺匹配提交

性能
- 前端入口包 JS 1.05MB→204KB、CSS 355KB→10.7KB（Element Plus 改按需 + el-config-provider）
- 载荷引用计数按指针里的 taskId 收敛（原 JSON 列 IN 全表扫且逐行调用）
- 店铺明细多值批量 INSERT；快照 upsert 预载缓存；结果文件列改单条 UPDATE
- 新增迁移 V120（补 3 个缺失索引）/V121（删 4 个被覆盖的冗余索引）/V122（URL 前缀索引）

稳定性
- 新增 common/util/ThreadPools 有界线程池替换 5 处无界队列（防堆积 OOM）
- Redis 锁释放改 Lua 原子校验（原裸 delete 会误删他人已过期的锁）
- imagevideo 加死节点接管；锁续期失败重试；调度池 4→16；openStream 全部加超时
- 事务内远程对象删除移到提交后；启动恢复锁按实例命名

客户端
- 不再 taskkill /f /im chrome.exe（改为按调试端口精准回收，不杀用户自己的浏览器）
- 密码检测不再无条件杀紫鸟进程；品牌检测加全局互斥（代理池不再互相覆盖）
- base_dir 统一到 exe 目录（原被 os.getcwd() 覆盖，日志/缓存会分裂两个目录）
- 缓存加定时清理；图片下载加超时；mkstemp 句柄托管

测试
- 同步更新受影响的契约测试（构造器签名/条件更新/方法改名/新增接口方法等）
- 修复 FaultInjectionTest 等 3 处 mock 未 stub 流式 read 导致的读循环 OOM
- mvn test 2795 个测试全绿

frontend-vue/tests/client-changelog.test.ts

@@ -0,0 +1,106 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  CLIENT_CHANGELOG,
+  newestChangelogVersion,
+  selectChangelogEntries,
+  type ClientChangelogEntry,
+} from '../src/shared/client-changelog.ts'
+
+const FIXTURE: ClientChangelogEntry[] = [
+  { version: '4.1.0', date: '2026-09-20', items: ['新功能甲'] },
+  { version: '4.0.11', date: '2026-09-13', items: ['修复乙'] },
+  { version: '4.0.9', date: '2026-09-13', items: ['修复丙'] },
+  { version: '4.0.4', date: '2026-09-13', items: ['修复丁'] },
+]
+
+test('更新日志：数据文件新版本在前且版本号唯一', () => {
+  const versions = CLIENT_CHANGELOG.map((entry) => entry.version)
+  assert.ok(versions.length > 0, '更新日志不应为空')
+  assert.deepEqual(
+    versions,
+    [...new Set(versions)],
+    '版本号不得重复（重复会让面板出现两条同名记录）',
+  )
+  const sorted = [...versions].sort((a, b) => {
+    const pa = a.split('.').map(Number)
+    const pb = b.split('.').map(Number)
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const diff = (pa[i] ?? 0) - (pb[i] ?? 0)
+      if (diff !== 0) return diff
+    }
+    return 0
+  })
+  assert.deepEqual(versions, sorted.reverse(), '更新日志应按版本号从新到旧排列')
+})
+
+test('更新日志：每条都有日期与面向用户的说明', () => {
+  for (const entry of CLIENT_CHANGELOG) {
+    assert.match(entry.version, /^\d+(\.\d+)+$/, `版本号格式异常：${entry.version}`)
+    assert.match(entry.date, /^\d{4}-\d{2}-\d{2}$/, `日期格式异常：${entry.version}`)
+    assert.ok(entry.items.length > 0, `缺少更新说明：${entry.version}`)
+    for (const item of entry.items) {
+      assert.ok(item.trim().length > 0, `更新说明为空：${entry.version}`)
+      assert.ok(item.length <= 40, `更新说明过长（面板放不下，需精简）：${entry.version} -> ${item}`)
+    }
+  }
+})
+
+test('更新日志：最新版本号取数据文件第一条', () => {
+  assert.equal(newestChangelogVersion(FIXTURE), '4.1.0')
+  assert.equal(newestChangelogVersion([]), '')
+})
+
+test('更新日志：只给本机版本之后的条目，新版本在前', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.11', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：落后多个版本时逐版本列出（含中间版本）', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.4', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0', '4.0.11', '4.0.9'])
+})
+
+test('更新日志：已是最新版本时没有条目（面板隐藏该区块）', () => {
+  assert.deepEqual(
+    selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.11', latestVersion: '4.0.11' }),
+    [],
+  )
+})
+
+test('更新日志：本机版本高于线上（灰度/回滚）不列条目', () => {
+  assert.deepEqual(
+    selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.1.0', latestVersion: '4.0.11' }),
+    [],
+  )
+})
+
+test('更新日志：线上已发布但日志未收录的新版本不误报旧条目', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.1.0', latestVersion: '4.2.0' })
+  assert.deepEqual(entries, [], '没有对应版本条目不倒推历史，避免把已装过的改动当成新内容')
+})
+
+test('更新日志：拿不到本机版本（旧客户端）时只给最新一条', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：检测未完成（线上版本为空）时按数据文件最新版本兜底', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.4', latestVersion: '' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0', '4.0.11', '4.0.9'])
+})
+
+test('更新日志：两边版本都拿不到时给数据文件最新一条', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：空数据不报错', () => {
+  assert.deepEqual(selectChangelogEntries({ entries: [], currentVersion: '4.0.4' }), [])
+})
+
+test('更新日志：版本号前缀 v 不影响筛选', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: 'v4.0.4', latestVersion: 'v4.0.11' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.0.11', '4.0.9'])
+})

frontend-vue/tests/modules-appearance-patent.test.ts

@@ -99,7 +99,7 @@ test('test_appearance_patent_progress_batch_timeout', async (t) => {
   const result = await getAppearancePatentTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/appearance-patent/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })

frontend-vue/tests/modules-collect-data.test.ts

@@ -66,7 +66,7 @@ test('test_collect_data_progress_batch', async (t) => {
   const result = await getCollectDataTaskProgressBatch([5, 3], { force: true })
   assert.equal(calls[0].url, '/newApi/api/collect-data/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })

frontend-vue/tests/modules-delete-brand.test.ts

@@ -97,7 +97,7 @@ test('test_delete_brand_task_details', async (t) => {
   await getDeleteBrandTaskDetails([5, 3])
   assert.equal(captured.url, '/newApi/api/delete-brand/tasks/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [5, 3] })
+  assert.deepEqual(captured.data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_delete_brand_task_download_url', async (t) => {
@@ -143,7 +143,7 @@ test('test_delete_brand_progress_batch', async (t) => {
   const result = await getDeleteBrandTaskProgress([5, 3])
   assert.equal(captured.url, '/newApi/api/delete-brand/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })

frontend-vue/tests/modules-price-track.test.ts

@@ -124,7 +124,7 @@ test('test_price_track_tasks_batch_delete', async (t) => {
   await deletePriceTrackTask(7)
   assert.equal(calls[0].url, '/newApi/api/price-track/tasks/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[0].data, { taskIds: [5, 3], userId: 42 })
   assert.equal(calls[1].url, '/newApi/api/price-track/tasks/7?user_id=42')
   assert.equal(calls[1].method, 'DELETE')
 })
@@ -173,7 +173,7 @@ test('test_price_track_progress_batch_timeout', async (t) => {
   const result = await getPriceTrackTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/price-track/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })

frontend-vue/tests/modules-publish.test.ts

@@ -105,7 +105,7 @@ test('test_publish_progress_batch_timeout', async (t) => {
   const result = await getPublishTaskProgressBatch([5, 3, 5])
   assert.equal(captured.url, '/newApi/api/publish/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { task_ids: [3, 5] })
+  assert.deepEqual(captured.data, { task_ids: [3, 5], user_id: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 

frontend-vue/tests/modules-query-asin.test.ts

@@ -132,7 +132,7 @@ test('test_shop_data_crawl_progress_batch_timeout', async (t) => {
   const result = await getShopDataCrawlTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/shop-data-crawl/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
@@ -204,7 +204,7 @@ test('test_query_asin_progress_delete_download', async (t) => {
   await deleteQueryAsinTask(7)
   await deleteQueryAsinHistory(9)
   assert.equal(calls[0].url, '/newApi/api/query-asin/tasks/progress/batch')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/query-asin/tasks/7')
   assert.equal(calls[1].method, 'DELETE')

frontend-vue/tests/modules-shop-match.test.ts

@@ -113,7 +113,7 @@ test('test_product_risk_task_apis', async (t) => {
   assert.equal(calls[2].url, '/newApi/api/product-risk-resolve/pending-shop-result')
   assert.deepEqual(calls[2].params, { user_id: 42, shop_name: '店铺A' })
   assert.equal(calls[3].url, '/newApi/api/product-risk-resolve/tasks/batch')
-  assert.deepEqual(calls[3].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[3].data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_product_risk_dashboard_history_download', async (t) => {
@@ -199,7 +199,7 @@ test('test_shop_match_task_apis', async (t) => {
   assert.equal(calls[3].url, '/newApi/api/shop-match/tasks/7/stage-finished?user_id=42')
   assert.deepEqual(calls[3].data, { stage_index: 1 })
   assert.equal(calls[4].url, '/newApi/api/shop-match/tasks/batch')
-  assert.deepEqual(calls[4].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[4].data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_shop_match_dashboard_history_skip_asins', async (t) => {
@@ -236,10 +236,10 @@ test('test_shop_match_product_risk_progress_batch', async (t) => {
   const shopMatch = await getShopMatchTaskProgressBatch([5, 3])
   const productRisk = await getProductRiskTaskProgressBatch([5, 3])
   assert.equal(calls[0].url, '/newApi/api/shop-match/tasks/progress/batch')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/product-risk-resolve/tasks/progress/batch')
-  assert.deepEqual(calls[1].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[1].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[1].timeout, 10000)
   assert.deepEqual(shopMatch, { items: [], missingTaskIds: [] })
   assert.deepEqual(productRisk, { items: [], missingTaskIds: [] })

frontend-vue/tests/modules-similar-asin.test.ts

@@ -100,7 +100,7 @@ test('test_similar_asin_progress_batch_timeout', async (t) => {
   const result = await getSimilarAsinTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/similar-asin/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 

frontend-vue/tests/modules-withdraw.test.ts

@@ -114,7 +114,7 @@ test('test_withdraw_progress_dashboard_history', async (t) => {
   await deleteWithdrawHistory(9)
   assert.equal(calls[0].url, '/newApi/api/withdraw/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/withdraw/dashboard')
   assert.deepEqual(calls[1].params, { user_id: 42 })
@@ -208,7 +208,7 @@ test('test_patrol_delete_progress_dashboard_download', async (t) => {
   await deletePatrolDeleteHistory(9)
   assert.equal(calls[0].url, '/newApi/api/patrol-delete/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/patrol-delete/dashboard')
   assert.deepEqual(calls[1].params, { user_id: 42 })