0.10.1: 安全与业务逻辑加固、新品牌与部署加固

三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
  与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
  撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
  全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
  >4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
  后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
  nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)

internal/portal/conversations.go

@@ -136,7 +136,7 @@ func (s *Service) appendMessage(ctx context.Context, conversationID, role, conte
 	return ConversationMessage{Sequence: sequence, Role: role, Content: content, CreatedAt: created}, nil
 }
 
-func (s *Service) callApplication(ctx context.Context, appCode, secret string, messages []ConversationMessage, variables map[string]any) (map[string]any, string, error) {
+func (s *Service) callApplication(ctx context.Context, appCode, secret string, messages []ConversationMessage, variables map[string]any, conversationID string) (map[string]any, string, error) {
 	payloadMessages := make([]map[string]any, 0, len(messages))
 	for _, m := range messages {
 		payloadMessages = append(payloadMessages, map[string]any{"role": m.Role, "content": m.Content})
@@ -145,6 +145,9 @@ func (s *Service) callApplication(ctx context.Context, appCode, secret string, m
 	request := httptest.NewRequest(http.MethodPost, "/v1/applications/"+appCode+"/chat/completions", bytes.NewReader(payload)).WithContext(gateway.WithRequestID(ctx, "portal-"+time.Now().UTC().Format("20060102150405.000000000")))
 	request.Header.Set("Authorization", "Bearer "+secret)
 	request.Header.Set("Content-Type", "application/json")
+	if strings.TrimSpace(conversationID) != "" {
+		request.Header.Set("X-Gateway-Conversation-ID", conversationID)
+	}
 	recorder := httptest.NewRecorder()
 	s.runtime.ServeHTTP(recorder, request)
 	var response map[string]any
@@ -180,7 +183,7 @@ func (s *Service) Chat(ctx context.Context, account identity.Account, code, mess
 	if err != nil {
 		return nil, err
 	}
-	response, _, err := s.callApplication(ctx, app.Code, secret, []ConversationMessage{{Role: "user", Content: message}}, variables)
+	response, _, err := s.callApplication(ctx, app.Code, secret, []ConversationMessage{{Role: "user", Content: message}}, variables, "")
 	return response, err
 }
 
@@ -223,7 +226,7 @@ func (s *Service) AppendConversationMessage(ctx context.Context, account identit
 	history := make([]ConversationMessage, len(conversation.Messages)+1)
 	copy(history, conversation.Messages)
 	history[len(conversation.Messages)] = ConversationMessage{Role: "user", Content: message}
-	response, answer, err := s.callApplication(ctx, code, secret, history, variables)
+	response, answer, err := s.callApplication(ctx, code, secret, history, variables, id)
 	if err != nil {
 		return response, err
 	}