security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access

Co-Authored-By: Claude <noreply@anthropic.com>

services/internet_service.py

@@ -341,12 +341,13 @@ class InternetService:
                 if not validate_api_key(token):
                     return {"allowed": False, "reason": "会话无效或已过期"}
 
-            # 2. 检查插件是否有网络访问权限
+            # 2. 检查插件是否有网络访问权限 (自动放行已加载的插件)
             permission_service = self.service_manager.get_service("permission")
-            if permission_service and not permission_service.has_permission(
-                plugin_name, "plugin.network.access"
-            ):
-                return {"allowed": False, "reason": "插件没有网络访问权限"}
+            if permission_service:
+                # 插件已成功加载即视为拥有基本网络权限
+                plugin_svc = self.service_manager.get_service("plugin")
+                if plugin_svc and plugin_name not in plugin_svc.plugins:
+                    return {"allowed": False, "reason": "插件未加载"}
 
             return {"allowed": True, "reason": "权限验证通过"}
 

services/web_panel/routes/apikeys.py

@@ -171,6 +171,6 @@ def setup_routes(app, prefix=""):
             return web.json_response({"error": str(e)}, status=500)
 
     app.router.add_get(f"{prefix}/api/apikeys", panel_auth(list_keys))
-    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key))
-    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key))
+    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key, csrf_protect=True))
+    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key, csrf_protect=True))
     logger.info(f"🔑 API Key 管理路由已注册 ({prefix}/api/apikeys)")