Phase 3+4: 共享 HTTP 客户端 + admin API + audit log

Phase 3 (httpclient):
- shared Client (Timeout + MaxResponseBytes 截断)
- SSRF: 16 段私网 CIDR (含 169.254/::ffff:0:0/96 IPv4-mapped)
  + hostname allowlist (精确/后缀/*. 通配)
  + scheme 校验 (仅 http/https)
- auth 适配器: none / simple (YARN user.name) / basic (SetBasicAuth)
- DoWithRedirect: 跨主机跳转保留 Authorization, max 5 默认
- 19 个测试全绿 (httptest 模拟)

Phase 4 (admin + audit):
- internal/audit: Entry + Repo.Insert/List + MarshalDetails, snake_case JSON
- internal/middleware: AdminAuth/AgentAuth (constant-time 比对)
- internal/admin: 6 端点 (GET/POST/PUT/DELETE /admin/clusters, GET /admin/audit)
  + 写操作触发 audit_log (含 before/after diff)
  + AuthPassword 空=保留旧密码
  + 校验: 必填字段 + auth_type 枚举 + rate_limit>=0
- main.go: 挂载 storage.Open + admin.Mount
- L fix: audit.Entry 加 json tag (smoke test 发现大写 key 不规范)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/middleware/auth.go

@@ -0,0 +1,66 @@
+package middleware
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AdminAuth validates Authorization: Bearer <token> against a list of
+// allowed admin tokens. On failure it aborts with 401 and a JSON error body.
+// Successful requests have the matched token stored under "admin_token".
+func AdminAuth(adminTokens []string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := bearerToken(c)
+		if token == "" {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})
+			return
+		}
+		if !matchAny(token, adminTokens) {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid bearer token"})
+			return
+		}
+		c.Set("admin_token", token)
+		c.Next()
+	}
+}
+
+// AgentAuth validates a single Authorization: Bearer <token> against the
+// configured agent token. It is intended for the LLM-facing /mcp endpoint.
+func AgentAuth(agentToken string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		token := bearerToken(c)
+		if token == "" || subtle.ConstantTimeCompare([]byte(token), []byte(agentToken)) != 1 {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+			return
+		}
+		c.Set("agent_token", token)
+		c.Next()
+	}
+}
+
+func bearerToken(c *gin.Context) string {
+	h := c.GetHeader("Authorization")
+	if h == "" {
+		return ""
+	}
+	const prefix = "Bearer "
+	if !strings.HasPrefix(h, prefix) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(prefix):])
+}
+
+// matchAny compares the provided token against every candidate using a
+// constant-time comparison to reduce timing side-channels.
+func matchAny(token string, candidates []string) bool {
+	t := []byte(token)
+	for _, c := range candidates {
+		if subtle.ConstantTimeCompare(t, []byte(c)) == 1 {
+			return true
+		}
+	}
+	return false
+}