feat: 大量优化和bug修复

server/api/admin/system-config.get.ts

@@ -0,0 +1,33 @@
+// server/api/admin/system-config.get.ts - 读取系统配置（仅 superadmin 可访问）
+//
+// 流程：鉴权 → 二次校验 superadmin → 读 system_config 表 → 遮蔽 key → 返回
+// 安全边界：
+// - handler 内独立校验 role === 'superadmin'，不依赖 middleware
+// - API Key 只返回遮蔽预览（前4...后4），不返回明文
+// - 此接口不返回任何用户数据
+
+import { setResponseStatus } from "h3";
+import { getSysConfig, maskApiKey } from "~~/server/utils/sysConfig";
+import { apiErr, apiOk } from "~~/server/utils/response";
+import type { ISystemConfigResponse } from "~~/shared/types/settings";
+
+export default defineEventHandler(async (event): Promise<ISystemConfigResponse> => {
+  // 二次校验：必须是 superadmin 才能访问系统配置
+  const role = (event.context.auth?.user as { role?: string } | undefined)
+    ?.role;
+  if (role !== "superadmin") {
+    setResponseStatus(event, 403);
+    return apiErr(403, "权限不足") as ISystemConfigResponse;
+  }
+
+  const cfg = await getSysConfig();
+
+  return apiOk({
+    openAiApiBase: cfg.openAiApiBase,
+    openAiApiKeyPreview: maskApiKey(cfg.openAiApiKey),
+    openAiModel: cfg.openAiModel,
+    maxTokens: cfg.maxTokens,
+    temperature: cfg.temperature,
+    maxSseLineBytes: cfg.maxSseLineBytes
+  });
+});