security: 公网生产环境加固 — P0/P1 全部修复

API 认证 (16 个未保护端点 → 全部加 panel_auth):
- 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...)
- 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀
- 代理管理: 3 端点 (list/add/remove)
- 系统状态: 2 HTTP + 1 WS (token 校验)
- 插件页面: 3 端点 (page/sse/event)
- 内部路由: 3 端点 (plugins/commands/data)

认证系统加固:
- 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐
- 默认密码警告: 启动时检测并打印 critical 级别日志
- 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429

基础设施:
- 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy
- WebSocket 鉴权: query string token 校验

Co-Authored-By: Claude <noreply@anthropic.com>

services/internet_service.py

@@ -19,6 +19,7 @@ class InternetService:
         self.config = config
         self.service_manager = service_manager
         self.http_app = web.Application()
+        self._setup_security_middleware()
         self.http_runner = None
         self.ws_connections: Dict[str, List] = {}
         self.plugin_routes: Dict[str, List] = {}
@@ -149,19 +150,37 @@ class InternetService:
         except Exception as e:
             logger.error(f"保存网络配置时出错: {str(e)}")
         
+    def _setup_security_middleware(self):
+        """注入安全响应头中间件"""
+
+        @web.middleware
+        async def security_headers(request, handler):
+            resp = await handler(request)
+            resp.headers.setdefault("X-Content-Type-Options", "nosniff")
+            resp.headers.setdefault("X-Frame-Options", "DENY")
+            resp.headers.setdefault("X-XSS-Protection", "1; mode=block")
+            resp.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+            # 生产环境有反向代理 TLS 时可开启:
+            # resp.headers.setdefault("Strict-Transport-Security", "max-age=31536000")
+            return resp
+
+        self.http_app.middlewares.append(security_headers)
+
     def _setup_default_routes(self):
         """设置默认路由"""
-        # 健康检查端点
+        from services.web_panel.utils.auth import panel_auth
+
+        # 健康检查端点 (公开，不暴露内部信息)
         self.http_app.router.add_get('/health', self._handle_health_check)
-        
-        # 插件API端点
-        self.http_app.router.add_get('/api/plugins', self._handle_get_plugins)
-        self.http_app.router.add_get('/api/commands', self._handle_get_commands)
-        
-        # 数据接收端点
-        self.http_app.router.add_post('/api/data', self._handle_data_receive)
-        
-        logger.debug("默认路由设置完成")
+
+        # 插件API端点 (加认证)
+        self.http_app.router.add_get('/api/plugins', panel_auth(self._handle_get_plugins))
+        self.http_app.router.add_get('/api/commands', panel_auth(self._handle_get_commands))
+
+        # 数据接收端点 (加认证)
+        self.http_app.router.add_post('/api/data', panel_auth(self._handle_data_receive))
+
+        logger.debug("默认路由设置完成 (已加认证)")
     
     async def register_plugin_route(self, plugin_name: str, route_path: str, 
                                   handler: Callable, methods: List[str] = ["GET"],