feat(server,dashboard): 引入多工作流数据隔离、安全中间件与前端 ESM 模块化重构

- server: 实现按 workflow_name 的多工作流数据隔离与旧数据库平滑迁移机制
- server: 新增 API Key 认证(auth)、限流中间件(rate_limit)与运维备份接口(admin)
- server: 统一 AppError 错误处理体系，重构调度器 scheduler 支持工作流级重置与抢占
- node: 节点 ID 缺失时自动生成随机 UUID，原生支持 `docker compose --scale node=N` 动态扩容
- dashboard: 前端模块化重构(state/api/components)，升级 CSS 变量设计系统与 Toast 通知
- docker/docs: 更新 /healthz 健康检查、部署脚本 IP 配置及数据库设计文档

Dockerfile.server

@@ -4,16 +4,29 @@
 
 # ─── Stage 1: 前端静态资源构建 ────────────────────────────────────────────────
 FROM node:22-alpine AS frontend-builder
+
+ARG USE_MIRRORS=1
 WORKDIR /app/dashboard
+
+RUN if [ "$USE_MIRRORS" = "1" ]; then \
+      npm config set registry https://registry.npmmirror.com; \
+    fi
+
 COPY dashboard/package.json dashboard/package-lock.json* ./
 RUN npm install
 COPY dashboard/ ./
 RUN npm run build
 
 # ─── Stage 2: Rust 服务端编译 (Alpine/musl 静态编译) ─────────────────────────
-FROM rust:1.80-alpine AS backend-builder
+FROM rust:1.94-alpine AS backend-builder
 
-RUN apk add --no-cache musl-dev g++ make pkgconfig sqlite-dev
+ARG USE_MIRRORS=1
+
+RUN if [ "$USE_MIRRORS" = "1" ]; then \
+      sed -i 's|dl-cdn.alpinelinux.org|mirrors.aliyun.com|g' /etc/apk/repositories; \
+    fi
+
+RUN apk add --no-cache musl-dev g++ make cmake pkgconfig sqlite-dev openssl-dev openssl-libs-static
 
 WORKDIR /app
 ENV SKIP_DASHBOARD_BUILD=1
@@ -21,13 +34,20 @@ ENV SKIP_DASHBOARD_BUILD=1
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ ./crates/
 COPY tools/ ./tools/
+COPY assets/tlusty_static assets/synspec_static ./assets/
 COPY --from=frontend-builder /app/dashboard/dist ./dashboard/dist
 
 RUN cargo build --release -p server && \
     cp /app/target/release/server /usr/local/bin/dcts-server
 
 # ─── Stage 3: 最小化生产运行镜像 ─────────────────────────────────────────────
-FROM alpine:3.20
+FROM alpine:3.21
+
+ARG USE_MIRRORS=1
+
+RUN if [ "$USE_MIRRORS" = "1" ]; then \
+      sed -i 's|dl-cdn.alpinelinux.org|mirrors.aliyun.com|g' /etc/apk/repositories; \
+    fi
 
 RUN apk add --no-cache ca-certificates tzdata sqlite
 
@@ -38,7 +58,6 @@ WORKDIR /app
 
 COPY --from=backend-builder /usr/local/bin/dcts-server /app/
 COPY --from=frontend-builder /app/dashboard/dist ./dashboard/dist
-COPY config_dense.yaml ./
 
 RUN mkdir -p /app/data /app/data/results /app/logs /app/assets && \
     chown -R dcts:dcts /app
@@ -51,11 +70,14 @@ ENV DCTS_PORT=8090
 ENV DCTS_DB_PATH=/app/data/dcts.db
 ENV DCTS_QUEUE_DB_PATH=/app/data/dcts_queue.db
 ENV DCTS_RESULTS_DIR=/app/data/results
+ENV DCTS_BACKUP_DIR=/app/data/backups
 ENV DCTS_ASSETS_DIR=/app/assets
 
 VOLUME ["/app/data", "/app/logs"]
 
+# 健康检查走不走鉴权的 /healthz（启用 admin/enrollment token 后 /api/status 返回 401，
+# 会令容器被误判不健康而反复重启）。与 docker-compose.yml 的 healthcheck 保持一致。
 HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
-    CMD wget -q --spider http://localhost:8090/api/status || exit 1
+    CMD wget -q --spider http://localhost:8090/healthz || exit 1
 
 ENTRYPOINT ["/app/dcts-server"]