🔒️ security(server): 业务接口保护开关与存活探针

- access_key 改用 subtle.ConstantTimeCompare 常量时间比较，防时序攻击
- 新增 server.protect_all 配置：开启后业务接口（/search、/content 等）也要求访问密钥
- 代理路由（/audio/proxy/、/manga/image/）不参与保护，其 URL 由服务端生成不含 key
- 新增 /healthz 存活探针（不校验密钥，供容器/反代使用）
- openapi.yaml 补 /healthz 定义，Unauthorized 描述说明 protect_all 行为
- 新增 3 个测试：保护开关放行、healthz、错误响应行为

cmd/fanqie/main.go

@@ -138,28 +138,30 @@ func setupRoutes() {
 	http.HandleFunc("/self-info", handlers.RequireAccessKey(handlers.HandleSelfInfo))
 	http.HandleFunc("/vacuum", handlers.RequireAccessKey(handlers.HandleVacuum))
 
-	// API端点
-	http.HandleFunc("/search", handlers.HandleSearch)
-	http.HandleFunc("/detail", handlers.HandleDetail)
-	http.HandleFunc("/info", handlers.HandleDetail)
-	http.HandleFunc("/catalog", handlers.HandleCatalog)
-	http.HandleFunc("/directory/all_items", handlers.HandleCatalog)
-	http.HandleFunc("/multi-detail", handlers.HandleMultiDetail)
-	http.HandleFunc("/multi-content", handlers.HandleMultiContent)
-	http.HandleFunc("/content", handlers.HandleContent)
-	http.HandleFunc("/item-summary", handlers.HandleItemSummary)
-	http.HandleFunc("/category-front", handlers.HandleCategoryFront)
-	http.HandleFunc("/category-landing", handlers.HandleCategoryLanding)
-	http.HandleFunc("/audio", handlers.HandleAudio)
+	http.HandleFunc("/healthz", handlers.HandleHealth)
+
+	// API端点（protect_all 开启时要求访问密钥；代理路由不包，URL 由服务端生成不含 key）
+	http.HandleFunc("/search", handlers.OptionalAccessKey(handlers.HandleSearch))
+	http.HandleFunc("/detail", handlers.OptionalAccessKey(handlers.HandleDetail))
+	http.HandleFunc("/info", handlers.OptionalAccessKey(handlers.HandleDetail))
+	http.HandleFunc("/catalog", handlers.OptionalAccessKey(handlers.HandleCatalog))
+	http.HandleFunc("/directory/all_items", handlers.OptionalAccessKey(handlers.HandleCatalog))
+	http.HandleFunc("/multi-detail", handlers.OptionalAccessKey(handlers.HandleMultiDetail))
+	http.HandleFunc("/multi-content", handlers.OptionalAccessKey(handlers.HandleMultiContent))
+	http.HandleFunc("/content", handlers.OptionalAccessKey(handlers.HandleContent))
+	http.HandleFunc("/item-summary", handlers.OptionalAccessKey(handlers.HandleItemSummary))
+	http.HandleFunc("/category-front", handlers.OptionalAccessKey(handlers.HandleCategoryFront))
+	http.HandleFunc("/category-landing", handlers.OptionalAccessKey(handlers.HandleCategoryLanding))
+	http.HandleFunc("/audio", handlers.OptionalAccessKey(handlers.HandleAudio))
 	http.HandleFunc("/audio/proxy/", handlers.HandleAudioProxy)
-	http.HandleFunc("/video", handlers.HandleVideo)
-	http.HandleFunc("/manga", handlers.HandleManga)
+	http.HandleFunc("/video", handlers.OptionalAccessKey(handlers.HandleVideo))
+	http.HandleFunc("/manga", handlers.OptionalAccessKey(handlers.HandleManga))
 	http.HandleFunc("/manga/image/", handlers.HandleMangaImageProxy)
-	
+
 	// 评论相关端点
-	http.HandleFunc("/chapter_review", handlers.HandleChapterReview)
-	http.HandleFunc("/review", handlers.HandleReview)
-	http.HandleFunc("/review_html", handlers.HandleReviewHTML)
+	http.HandleFunc("/chapter_review", handlers.OptionalAccessKey(handlers.HandleChapterReview))
+	http.HandleFunc("/review", handlers.OptionalAccessKey(handlers.HandleReview))
+	http.HandleFunc("/review_html", handlers.OptionalAccessKey(handlers.HandleReviewHTML))
 	
 	// 表情图片静态文件服务
 	http.Handle("/emoji/", http.StripPrefix("/emoji/", http.FileServer(http.Dir("emoji"))))