security: 公网生产环境加固 — P0/P1 全部修复

API 认证 (16 个未保护端点 → 全部加 panel_auth):
- 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...)
- 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀
- 代理管理: 3 端点 (list/add/remove)
- 系统状态: 2 HTTP + 1 WS (token 校验)
- 插件页面: 3 端点 (page/sse/event)
- 内部路由: 3 端点 (plugins/commands/data)

认证系统加固:
- 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐
- 默认密码警告: 启动时检测并打印 critical 级别日志
- 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429

基础设施:
- 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy
- WebSocket 鉴权: query string token 校验

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/routes/files.py

@@ -28,6 +28,7 @@ import logging
 import mimetypes
 from pathlib import Path
 from aiohttp import web
+from ..utils.auth import panel_auth
 
 logger = logging.getLogger(__name__)
 
@@ -412,14 +413,14 @@ def setup_file_routes(app, service_manager, prefix=''):
             return web.json_response({"error": str(e)}, status=500)
 
     # ── Register routes ──
-    app.router.add_get(f'{prefix}/api/files/list', list_dir)
-    app.router.add_post(f'{prefix}/api/files/mkdir', mkdir)
-    app.router.add_post(f'{prefix}/api/files/touch', touch)
-    app.router.add_post(f'{prefix}/api/files/delete', delete)
-    app.router.add_post(f'{prefix}/api/files/rename', rename)
-    app.router.add_post(f'{prefix}/api/files/upload', upload)
-    app.router.add_get(f'{prefix}/api/files/download', download)
-    app.router.add_get(f'{prefix}/api/files/read', read_file)
-    app.router.add_post(f'{prefix}/api/files/write', write_file)
-    app.router.add_get(f'{prefix}/api/files/info', file_info)
-    app.router.add_get(f'{prefix}/api/files/picker', picker_api)
+    app.router.add_get(f'{prefix}/api/files/list', panel_auth(list_dir))
+    app.router.add_post(f'{prefix}/api/files/mkdir', panel_auth(mkdir))
+    app.router.add_post(f'{prefix}/api/files/touch', panel_auth(touch))
+    app.router.add_post(f'{prefix}/api/files/delete', panel_auth(delete))
+    app.router.add_post(f'{prefix}/api/files/rename', panel_auth(rename))
+    app.router.add_post(f'{prefix}/api/files/upload', panel_auth(upload))
+    app.router.add_get(f'{prefix}/api/files/download', panel_auth(download))
+    app.router.add_get(f'{prefix}/api/files/read', panel_auth(read_file))
+    app.router.add_post(f'{prefix}/api/files/write', panel_auth(write_file))
+    app.router.add_get(f'{prefix}/api/files/info', panel_auth(file_info))
+    app.router.add_get(f'{prefix}/api/files/picker', panel_auth(picker_api))