security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access

Co-Authored-By: Claude <noreply@anthropic.com>

config/permissions/granted_permissions.json

@@ -1,9 +1 @@
-{
-  "example_plugin": [
-    "framework.event.subscribe",
-    "framework.command.execute",
-    "plugin.example.execute",
-    "plugin.example.read",
-    "plugin.example.write"
-  ]
-}
+{}

config/permissions/pending_requests.json

@@ -1,18 +1,24 @@
 {
-  "10c4eb6e": {
-    "plugin_name": "example_plugin",
-    "permissions": [],
-    "timestamp": 484215.183089762
-  },
-  "d6f52ecd": {
-    "plugin_name": "example_plugin",
+  "c8a2c46a": {
+    "plugin_name": "sentinel",
     "permissions": [
-      "plugin.example.read",
-      "plugin.example.write",
-      "plugin.example.execute",
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
       "framework.event.subscribe",
       "framework.command.execute"
     ],
-    "timestamp": 484729.685713733
+    "timestamp": 16743.234435695
+  },
+  "87725a61": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 16793.53933677
   }
 }

config/permissions/plugin_status.json

@@ -1,3 +1,3 @@
 {
-  "example_plugin": "granted"
+  "sentinel": "pending"
 }

config/plugins/commands.yaml

@@ -79,6 +79,10 @@ commands:
     permissions:
     - framework.tui.control
     source: internal
+  sentinel: &id001
+    description: Sentinel 集群状态
+    permissions: []
+    source: plugin.sentinel
   status:
     description: 显示框架状态
     permissions:
@@ -89,6 +93,8 @@ commands:
     permissions:
     - framework.command.test
     source: internal
-last_updated: 14102.680173838
-plugin_commands: {}
-total_commands: 18
+last_updated: 16793.516549165
+plugin_commands:
+  sentinel:
+    sentinel: *id001
+total_commands: 19

config/services/network_routes.yaml

@@ -1,4 +1,25 @@
 http_port: 4200
-last_updated: 14102.696182483
-plugin_routes: {}
+last_updated: 16793.540021822
+plugin_routes:
+  sentinel:
+  - methods:
+    - GET
+    path: /sentinel/api/nodes
+    require_auth: true
+  - methods:
+    - POST
+    path: /sentinel/api/nodes
+    require_auth: true
+  - methods:
+    - POST
+    path: /sentinel/api/nodes/test
+    require_auth: true
+  - methods:
+    - POST
+    path: /sentinel/api/nodes/delete
+    require_auth: true
+  - methods:
+    - POST
+    path: /sentinel/api/plugin/sentinel
+    require_auth: true
 websocket_port: 4240