security: 公网生产环境加固 — P0/P1 全部修复

API 认证 (16 个未保护端点 → 全部加 panel_auth):
- 文件管理器: 11 端点 (list/mkdir/delete/upload/download/read/write/...)
- 项目管理: 6 端点 (list/run/stop/logs/stdin/page), 修复硬编码路径前缀
- 代理管理: 3 端点 (list/add/remove)
- 系统状态: 2 HTTP + 1 WS (token 校验)
- 插件页面: 3 端点 (page/sse/event)
- 内部路由: 3 端点 (plugins/commands/data)

认证系统加固:
- 密码哈希: 固定盐 → 每用户独立 secrets.token_hex(16) 随机盐
- 默认密码警告: 启动时检测并打印 critical 级别日志
- 登录频率限制: 5 次失败 / IP → 锁定 60 秒, 返回 429

基础设施:
- 安全响应头: X-Content-Type-Options/X-Frame-Options/X-XSS-Protection/Referrer-Policy
- WebSocket 鉴权: query string token 校验

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/routes/status.py

@@ -4,6 +4,7 @@ import asyncio
 import logging
 from aiohttp import web
 from ..utils.system_info import SystemInfoCollector
+from ..utils.auth import panel_auth
 
 collector = SystemInfoCollector()
 logger = logging.getLogger(__name__)
@@ -11,11 +12,25 @@ logger = logging.getLogger(__name__)
 # Track active system-status WS clients
 _sys_ws_clients: set = set()
 
+def _ws_auth_wrapper(handler):
+    """WebSocket 鉴权包装 — 从 query string 取 token 验证"""
+    async def wrapper(request):
+        token = request.query.get("token", "")
+        session_store = request.app.get("panel_session_store", {})
+        if not token or token not in session_store:
+            ws = web.WebSocketResponse()
+            await ws.prepare(request)
+            await ws.send_str(json.dumps({"error": "Unauthorized"}))
+            await ws.close(code=4001, message="Unauthorized")
+            return ws
+        return await handler(request)
+    return wrapper
+
 def setup_routes(app, prefix=''):
-    app.router.add_get(f'{prefix}/api/framework', get_framework)
-    app.router.add_get(f'{prefix}/api/system', get_system)
-    app.router.add_get(f'{prefix}/api/system/ws', sys_ws_handler)
-    logger.info(f"📡 系统状态WS端点已注册: {prefix}/api/system/ws")
+    app.router.add_get(f'{prefix}/api/framework', panel_auth(get_framework))
+    app.router.add_get(f'{prefix}/api/system', panel_auth(get_system))
+    app.router.add_get(f'{prefix}/api/system/ws', _ws_auth_wrapper(sys_ws_handler))
+    logger.info(f"📡 系统状态WS端点已注册: {prefix}/api/system/ws (已加认证)")
 
 def _read_version():
     """Read version from config file (shared helper)"""