0.10.1: 安全与业务逻辑加固、新品牌与部署加固

三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
  与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
  撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
  全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
  >4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
  后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
  nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)

internal/workbench/marketplace.go

@@ -258,7 +258,19 @@ func (s *MarketplaceService) Detail(ctx context.Context, resourceType, code stri
 			return item, nil, getErr
 		}
 		item = MarketItem{Type: "mcp_server", Code: server.Code, Name: server.Name, Description: server.Description, CategoryID: server.CategoryID, CategoryName: server.CategoryName, Tags: server.Tags, DepartmentIDs: server.DepartmentIDs, UpdatedAt: server.UpdatedAt}
-		detail = server
+		// 门户详情不得暴露 endpoint_url 与 has_secret_headers:内网服务拓扑和
+		// 密钥状态仅管理端可见(运行时列表同样省略该字段)。
+		raw, err := json.Marshal(server)
+		if err != nil {
+			return item, nil, err
+		}
+		var sanitized map[string]any
+		if err := json.Unmarshal(raw, &sanitized); err != nil {
+			return item, nil, err
+		}
+		delete(sanitized, "endpoint_url")
+		delete(sanitized, "has_secret_headers")
+		detail = sanitized
 	case "skill":
 		skill, getErr := s.skills.GetPublishedByCode(ctx, code)
 		if getErr != nil {
@@ -320,7 +332,9 @@ func (s *MarketplaceService) Install(ctx context.Context, resourceType, code, po
 }
 
 func (s *MarketplaceService) Uninstall(ctx context.Context, resourceType, code, portalUserID string) error {
-	resourceID, err := s.publishedResourceID(ctx, resourceType, code)
+	// 卸载不受 enabled/status 限制:管理员停用或归档资源后,用户仍能
+	// 移除自己的安装,否则安装行永久卡死、列表永远显示。
+	resourceID, err := s.resourceIDByCode(ctx, resourceType, code)
 	if err != nil {
 		return err
 	}
@@ -416,6 +430,23 @@ func (s *MarketplaceService) publishedResourceID(ctx context.Context, resourceTy
 	return id, mapNotFound(err)
 }
 
+// resourceIDByCode 按 code 解析资源 ID,不限制启用/发布状态(卸载场景使用)。
+func (s *MarketplaceService) resourceIDByCode(ctx context.Context, resourceType, code string) (string, error) {
+	var id string
+	var err error
+	switch resourceType {
+	case "mcp_server":
+		err = s.assets.pool.QueryRow(ctx, `SELECT id::text FROM gateway.mcp_servers WHERE code=$1`, code).Scan(&id)
+	case "skill":
+		err = s.assets.pool.QueryRow(ctx, `SELECT id::text FROM gateway.skills WHERE code=$1`, code).Scan(&id)
+	case "digital_employee":
+		err = s.assets.pool.QueryRow(ctx, `SELECT id::text FROM gateway.digital_employees WHERE code=$1`, code).Scan(&id)
+	default:
+		return "", errors.New("未知的资源类型")
+	}
+	return id, mapNotFound(err)
+}
+
 func (s *MarketplaceService) resourceByID(ctx context.Context, resourceType, id string) (MarketItem, bool, error) {
 	var item MarketItem
 	switch resourceType {