全面审查优化: 43项修复（安全/性能/可靠性）+ 文档更新

🔴 P0 安全: .env入gitignore, CSP/HSTS, Logo安全(5MB限制+SVG消毒+SHA256), middleware权限收紧(VIP不能访问admin), 发布去重, GitHub认证, 删除危险API, skill-discoverer绕过审核修复, prisma默认连接修复
🔴 P0 可靠性: deepseek/github超时重试, 脚本层DeepSeek保护, 脚本启动验证, OAuth竞态修复
🔴 P0 性能: skill-discoverer N+1优化(↓94%), 后台API分页限制, getUserStats聚合优化
🟡 P1: 分类动态加载, 星级字段统一, fetch-logos并发Bug修复, 批量发布冲突不删除, check-tools重试, 前端空指针修复(13处), logo-fetcher日志, rate-limit清理, 公开API缓存

scripts/daily-news.mjs

@@ -2,6 +2,7 @@ import { PrismaClient } from "@prisma/client";
 import { PrismaMariaDb } from "@prisma/adapter-mariadb";
 import OpenAI from "openai";
 import "dotenv/config";
+import { withRetry } from "./lib/retry.mjs";
 
 const base = process.env.DATABASE_URL || "mysql://localhost:3306/zhuiguang_ai?charset=utf8mb4";
 const sep = base.includes("?") ? "&" : "?";
@@ -280,11 +281,13 @@ async function generateDailyNews() {
     .replace(/\{newsData\}/g, newsDataText)
     .replace(/\{date\}/g, dateStr);
 
-  const completion = await openai.chat.completions.create({
-    model: "deepseek-v4-pro",
-    messages: [{ role: "user", content: prompt }],
-    temperature: 0.3,
-  });
+  const completion = await withRetry(async () => {
+    return await openai.chat.completions.create({
+      model: process.env.DEEPSEEK_MODEL || "deepseek-v4-pro",
+      messages: [{ role: "user", content: prompt }],
+      temperature: 0.3,
+    }, { signal: AbortSignal.timeout(120000) });
+  }, { maxRetries: 3, label: "DeepSeek News API" });
 
   const content = completion.choices[0]?.message?.content;
   if (!content) {
@@ -347,6 +350,9 @@ async function generateDailyNews() {
 }
 
 async function main() {
+  if (!process.env.DEEPSEEK_API_KEY) throw new Error("缺少环境变量: DEEPSEEK_API_KEY");
+  if (!process.env.DATABASE_URL) throw new Error("缺少环境变量: DATABASE_URL");
+
   const startTime = new Date();
   try {
     const report = await generateDailyNews();