Phase 3+4: 共享 HTTP 客户端 + admin API + audit log

Phase 3 (httpclient):
- shared Client (Timeout + MaxResponseBytes 截断)
- SSRF: 16 段私网 CIDR (含 169.254/::ffff:0:0/96 IPv4-mapped)
  + hostname allowlist (精确/后缀/*. 通配)
  + scheme 校验 (仅 http/https)
- auth 适配器: none / simple (YARN user.name) / basic (SetBasicAuth)
- DoWithRedirect: 跨主机跳转保留 Authorization, max 5 默认
- 19 个测试全绿 (httptest 模拟)

Phase 4 (admin + audit):
- internal/audit: Entry + Repo.Insert/List + MarshalDetails, snake_case JSON
- internal/middleware: AdminAuth/AgentAuth (constant-time 比对)
- internal/admin: 6 端点 (GET/POST/PUT/DELETE /admin/clusters, GET /admin/audit)
  + 写操作触发 audit_log (含 before/after diff)
  + AuthPassword 空=保留旧密码
  + 校验: 必填字段 + auth_type 枚举 + rate_limit>=0
- main.go: 挂载 storage.Open + admin.Mount
- L fix: audit.Entry 加 json tag (smoke test 发现大写 key 不规范)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/httpclient/auth_test.go

@@ -0,0 +1,99 @@
+package httpclient
+
+import (
+	"encoding/base64"
+	"net/http"
+	"strings"
+	"testing"
+
+	"spark-mcp-go/internal/cluster"
+)
+
+func TestApplyAuth_None(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://example.com/foo", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthNone}
+	if err := ApplyAuth(req, "", c); err != nil {
+		t.Fatalf("apply auth: %v", err)
+	}
+	if req.Header.Get("Authorization") != "" {
+		t.Errorf("expected no Authorization header")
+	}
+	if req.URL.Query().Get("user.name") != "" {
+		t.Errorf("expected no user.name query parameter")
+	}
+}
+
+func TestApplyAuth_Simple_DefaultUser(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthSimple}
+	if err := ApplyAuth(req, "", c); err != nil {
+		t.Fatalf("apply auth: %v", err)
+	}
+	if got := req.URL.Query().Get("user.name"); got != "yarn" {
+		t.Errorf("user.name=%q, want yarn", got)
+	}
+}
+
+func TestApplyAuth_Simple_CustomUser(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthSimple, AuthUsername: "alice"}
+	if err := ApplyAuth(req, "", c); err != nil {
+		t.Fatalf("apply auth: %v", err)
+	}
+	if got := req.URL.Query().Get("user.name"); got != "alice" {
+		t.Errorf("user.name=%q, want alice", got)
+	}
+}
+
+func TestApplyAuth_Simple_PreservesExistingQuery(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps?foo=bar", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthSimple}
+	if err := ApplyAuth(req, "", c); err != nil {
+		t.Fatalf("apply auth: %v", err)
+	}
+	q := req.URL.Query()
+	if q.Get("foo") != "bar" {
+		t.Errorf("foo=%q, want bar", q.Get("foo"))
+	}
+	if q.Get("user.name") != "yarn" {
+		t.Errorf("user.name=%q, want yarn", q.Get("user.name"))
+	}
+	raw := req.URL.RawQuery
+	if !strings.Contains(raw, "foo=bar") || !strings.Contains(raw, "user.name=yarn") {
+		t.Errorf("raw query %q missing expected parameters", raw)
+	}
+}
+
+func TestApplyAuth_Basic(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "u", AuthPassword: "p"}
+	if err := ApplyAuth(req, "", c); err != nil {
+		t.Fatalf("apply auth: %v", err)
+	}
+	want := "Basic " + base64.StdEncoding.EncodeToString([]byte("u:p"))
+	if got := req.Header.Get("Authorization"); got != want {
+		t.Errorf("Authorization=%q, want %q", got, want)
+	}
+}
+
+func TestApplyAuth_Basic_MissingCreds(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
+	c := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "", AuthPassword: "p"}
+	if err := ApplyAuth(req, "", c); err == nil {
+		t.Error("expected error for missing username")
+	}
+
+	req2, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
+	c2 := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "u", AuthPassword: ""}
+	if err := ApplyAuth(req2, "", c2); err == nil {
+		t.Error("expected error for missing password")
+	}
+}
+
+func TestApplyAuth_UnknownAuthType(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
+	c := &cluster.Cluster{AuthType: "kerberos"}
+	if err := ApplyAuth(req, "", c); err == nil {
+		t.Error("expected error for unknown auth type")
+	}
+}