feat: 新增工具插件、系统日志、workflow配置及前端优化

1. 新增工具插件(edit_file, python_executor, search_file, shell_executor, write_file)
2. 新增系统事件日志模块和API
3. 新增workflow配置文件和详情API
4. 前端增加SSE、错误边界、设置引导等组件
5. 优化认证加密、速率限制、配置加载等工具模块
6. 删除废弃的cluster和health API
7. 补充单元测试和集成测试

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kilostar/api/auth.py

@@ -12,7 +12,7 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Request
 from fastapi import Depends
 from pydantic import BaseModel
 from kilostar.utils.access import Accessor, TokenData
@@ -21,6 +21,7 @@ from kilostar.utils.ray_hook import ray_actor_hook
 from kilostar.utils.check_user.role_check import RoleChecker
 from kilostar.core.postgres_database.model import UserAuthority
 from kilostar.utils.error import UserNotExistError
+from kilostar.utils.rate_limit import register_limiter, login_limiter
 
 auth_router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
 
@@ -33,8 +34,9 @@ class UserRegister(BaseModel):
 
 
 @auth_router.post("/register")
-async def create_user(user_register: UserRegister):
+async def create_user(user_register: UserRegister, request: Request):
     """注册新用户：异步线程池里做 argon2 哈希，再交由 PostgresDatabase Actor 落库。"""
+    register_limiter.check(request)
     postgres_database = ray_actor_hook("postgres_database").postgres_database
     hashed_password = await run_in_threadpool(
         Accessor.hash_password, user_register.password
@@ -53,16 +55,39 @@ class UserLogin(BaseModel):
 
 
 @auth_router.post("/login")
-async def login_user(user_login: UserLogin):
+async def login_user(user_login: UserLogin, request: Request):
     """用户登录：查询用户后在线程池中校验口令，校验成功则签发 JWT。"""
+    login_limiter.check(request)
     postgres_database = ray_actor_hook("postgres_database").postgres_database
     user = await postgres_database.login_user.remote(user_login.user_name)
     if not user:
         raise UserNotExistError()
-    token = await run_in_threadpool(
+    tokens = await run_in_threadpool(
         Accessor.login_hashed_password, user, user_login.password
     )
-    return {"message": "success", "token": token}
+    return {
+        "message": "success",
+        "token": tokens["access_token"],
+        "access_token": tokens["access_token"],
+        "refresh_token": tokens["refresh_token"],
+    }
+
+
+class RefreshTokenRequest(BaseModel):
+    """``POST /refresh`` 入参：refresh token。"""
+
+    refresh_token: str
+
+
+@auth_router.post("/refresh")
+async def refresh_token(body: RefreshTokenRequest):
+    """用 refresh token 换取新的 access token + refresh token 对。"""
+    tokens = Accessor.refresh_access_token(body.refresh_token)
+    return {
+        "message": "success",
+        "access_token": tokens["access_token"],
+        "refresh_token": tokens["refresh_token"],
+    }
 
 
 class ChangeAuthorityRequest(BaseModel):