fix: 修复 Code Review 发现的 4 个 High + 1 个 Medium 问题

High-1/2: baseline mode 违反 DB CHECK 约束
- ck_mode_enum 扩展为 ('single','multi','baseline')
- baseline 的 run_type 从 'baseline' 改为 'live'(符合现有约束)
- 新增迁移 0017_mode_baseline

High-3: 限流日志 NameError: ip 未定义
- deps.py:190 的 logger.warning 中 ip → client_ip

High-4: 生产 Cookie 缺少 Secure 标志
- auth.py 登录时根据 APP_ENV 设置 secure=True(生产)

Medium-5: 降级日志参数类型错误
- orchestrator.py:266 ok_reports(list) → len(ok_reports)(int)

附加: PredictRequest mode 字段加 pattern 校验,与 DB 约束同源

Co-Authored-By: new-provider/LongCat-2.0 <<EMAIL>>

src/api/routes/auth.py

@@ -83,6 +83,8 @@ async def login(body: LoginIn, request: Request, response: Response):
         raise HTTPException(status_code=401, detail="密码错误")
 
     _fail_times.pop(ip, None)
+    # Code Review High-4: 生产环境(HHTTPS)下 Cookie 必须带 Secure,防中间人窃取
+    secure = settings.APP_ENV == "production"
     response.set_cookie(
         key=SESSION_COOKIE,
         value=create_session_token(await get_session_secret()),
@@ -90,6 +92,7 @@ async def login(body: LoginIn, request: Request, response: Response):
         httponly=True,
         samesite="lax",
         path="/",
+        secure=secure,
     )
     logger.info("管理员登录成功 (ip=%s)", ip)
     return {"ok": True, "expires_in_hours": settings.ADMIN_SESSION_TTL_HOURS}

src/api/routes/predict.py

@@ -116,7 +116,7 @@ async def _persist_baseline(match_id: int, baseline: dict) -> int:
             provider_name="baseline",
             model="baseline",
             mode="baseline",
-            run_type="baseline",
+            run_type="live",  # baseline 是 live 预测的变体,符合 ck_run_type_enum
             values={
                 "prompt_version": "baseline_v1",
                 "prompt_tokens": 0,