feat: 核心模块增强 — 加密 + 运行时配置 + 日志缓冲

- crypto.py: API Key 加密/解密工具
- runtime_config.py: 运行时动态配置管理
- log_buffer.py: 内存日志缓冲区
- config.py: 新增加密配置项
- http_client.py: 增强重试和错误处理

src/api/app.py

@@ -15,17 +15,29 @@ from src.core.config import settings
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
     from src.db.base import init_db
     from src.core.http_client import close_client
+    from src.core.runtime_config import (
+        ensure_admin_password_hashed,
+        migrate_plaintext_sensitive_settings,
+    )
     await init_db()  # 验证连接,不建表
+    await migrate_plaintext_sensitive_settings()  # 明文敏感配置 → 加密(幂等)
+    await ensure_admin_password_hashed()  # .env 明文密码 → scrypt 哈希(幂等)
     yield
     await close_client()
 
 
 def create_app() -> FastAPI:
+    from src.core.log_buffer import setup_memory_logging
+    setup_memory_logging(settings.LOG_LEVEL)
+
+    # 生产环境不暴露 OpenAPI 文档(避免向访客泄露接口结构)
+    openapi_url = "/openapi.json" if settings.APP_ENV != "production" else None
     app = FastAPI(
         title="Profeto API",
         description="足球数据 + LLM 预测服务",
         version="0.1.0",
         lifespan=lifespan,
+        openapi_url=openapi_url,
     )
 
     origins = [o.strip() for o in settings.CORS_ORIGINS.split(",") if o.strip()]
@@ -44,12 +56,16 @@ def create_app() -> FastAPI:
     from src.api.routes.ingest import router as ingest_router
     from src.api.routes.eval import router as eval_router
     from src.api.routes.backtest import router as backtest_router
+    from src.api.routes.auth import router as auth_router
+    from src.api.routes.admin_settings import router as admin_settings_router
 
     app.include_router(matches_router)
     app.include_router(predict_router)
     app.include_router(ingest_router)
     app.include_router(eval_router)
     app.include_router(backtest_router)
+    app.include_router(auth_router)
+    app.include_router(admin_settings_router)
 
     @app.get("/health")
     async def health():