security: P3 — 插件隔离默认开启 + SenSuDB 注册 + 审计日志

- plugins.isolation 默认 true (生产环境进程隔离)
- main.py 注册 SenSuDB 服务
- WebPanelManager 注入 sensu_db 到 app context
- 文件删除/写入操作写入审计日志 (audit_log 表)
- 修复 Session 持久化所需的数据库依赖

Co-Authored-By: Claude <noreply@anthropic.com>

services/web_panel/manager.py

@@ -33,6 +33,7 @@ class WebPanelManager:
         app['service_manager'] = self.sm
         app['auth_service'] = self.sm.get_service("auth")
         app['log_service'] = self.sm.get_service("log")
+        app['sensu_db'] = self.sm.get_service("sensu_db")
         app['panel_config'] = {
             'username': self.panel_user,
             'password': self.panel_pass,

services/web_panel/routes/files.py

@@ -272,6 +272,10 @@ def setup_file_routes(app, service_manager, prefix=''):
             else:
                 p.unlink()
             logger.info(f"🗑 删除: {p}")
+            # 审计日志
+            db = request.app.get("sensu_db")
+            if db:
+                db.log_audit(request.get("user", {}).get("username", "?"), "file_delete", str(p))
             return web.json_response({"ok": True})
         except Exception as e:
             return web.json_response({"error": str(e)}, status=500)
@@ -375,6 +379,9 @@ def setup_file_routes(app, service_manager, prefix=''):
             content = data.get("content", "")
             p.write_text(content, encoding="utf-8")
             logger.info(f"💾 写入文件: {p} ({len(content)} bytes)")
+            db = request.app.get("sensu_db")
+            if db:
+                db.log_audit(request.get("user", {}).get("username", "?"), "file_write", str(p))
             return web.json_response({"ok": True, "size": len(content)})
         except Exception as e:
             return web.json_response({"error": str(e)}, status=500)