refactor: fix P0/P1/P2 security and performance issues

P0 fixes:
- CORS: replace wildcard methods/headers with configurable lists
- deps.py: remove unsafe global _warned_unset variable

P1 fixes:
- http_client: read default timeout from Settings
- bzzoiro: replace sync urllib with async httpx
- bzzoiro: normalize validation failures use warning level only
- db pool: read pool config from Settings (default 5+10)
- backtest: add asyncio.Semaphore(8) for concurrent execution
- predict/context_builder: add backtest parameter for cutoff buffer

P2 improvements:
- injuries: enforce int conversion for player_id/fixture_id
- injuries: use system temp dir for cache
- utils.py: extract shared actual_1x2/is_correct_1x2
- validation: downgrade 1x2 mismatch log to debug
- docker-compose: use env vars for all credentials
- .env.example: add POSTGRES_USER/PASSWORD/PORT, API_PORT

src/llm/utils.py

@@ -0,0 +1,19 @@
+"""LLM 模块共享工具函数。"""
+from __future__ import annotations
+
+
+def actual_1x2(home: int, away: int) -> str:
+    """实际比分 → 胜平负。
+
+    单一权威源: backtest.py 和 eval.py 共用,避免重复定义。
+    """
+    if home > away:
+        return "1"
+    if home == away:
+        return "X"
+    return "2"
+
+
+def is_correct_1x2(pred: str | None, actual: str) -> bool:
+    """预测是否命中胜平负。"""
+    return pred == actual