Phase 0+1+2 续: 项目骨架 + 配置 + 日志 + 存储层

Phase 0 (项目骨架):
- main.go 改为最小骨架 (config + logging + gin + /healthz + 优雅退出)
- internal/{config,logging,storage,cluster,...}/ 目录占位

Phase 1 (配置 + 日志):
- internal/config: env 解析 + 必填校验 + token 隐藏的 String()
- internal/logging: slog multi-handler 双输出 (终端 text + 主文件 JSON)
  + StartToolCall per-tool 独立文件 (0600), tools 目录 0700

Phase 2 续 (存储层):
- internal/cluster: 16 字段 Cluster struct (AuthPassword json:"-")
- internal/storage: modernc.org/sqlite 接入, WAL 模式, schema 自动迁移
- ClusterRepo CRUD: Create/Get/List/Update/Delete + ErrNotFound
  + AuthPassword 空字符串 = 保留旧密码 (核心约定)
- 7 个单元测试全绿 (:memory: DB)
- created_at/updated_at 改纳秒精度, 消除 List 测试的 sleep 特殊 case

Co-Authored-By: Claude <noreply@anthropic.com>

internal/cluster/types.go

@@ -0,0 +1,56 @@
+// Package cluster defines the Cluster domain type — a configured Spark/YARN
+// endpoint pair plus authentication, SSL, rate-limit, and Spark-submit metadata.
+//
+// Cluster is the only entity persisted in this project besides the audit log.
+// It is the discovery root for the LLM agent: list_clusters returns the full
+// struct (minus the password) so the agent can resolve RM/SHS URLs, choose
+// the correct auth flavor, and respect the URL allowlist.
+package cluster
+
+import "time"
+
+// AuthType enumerates the YARN/Hadoop authentication flavors supported in v1.
+//
+//	"none"   — no credentials; public or pre-trusted clusters
+//	"simple" — YARN SimpleAuth: appends ?user.name=<username> to every request
+//	"basic"  — HTTP Basic; AuthUsername + AuthPassword (encrypted at rest)
+//
+// Kerberos is intentionally absent in v1; the deployment uses SimpleAuth.
+type AuthType string
+
+const (
+	AuthNone   AuthType = "none"
+	AuthSimple AuthType = "simple"
+	AuthBasic  AuthType = "basic"
+)
+
+// Cluster is one configured Spark-on-YARN endpoint pair.
+//
+// Field semantics:
+//   - SparkSubmitExecuteBin: absolute path to spark-submit (or spark2-submit);
+//     exec.Command uses this binary directly, never the shell.
+//   - IsActive: only active clusters are returned by LLM-facing list_clusters.
+//   - AuthPassword: zero value ("") on Update means "do not touch the stored
+//     password" — keeps the existing encrypted blob intact.
+//   - URLAllowlist: extra glob patterns beyond the RM/SHS hosts; fetch_url
+//     uses this to permit long-tail SHS endpoints the agent may construct.
+//   - DefaultSubmitArgs: prepended to every spark_submit Tool call's args.
+//   - RateLimitPerMin: 0 disables the per-cluster limiter.
+type Cluster struct {
+	ID                    string    `json:"id"`
+	Name                  string    `json:"name"`
+	RMURL                 string    `json:"rm_url"`
+	SHSURL                string    `json:"shs_url"`
+	SparkSubmitExecuteBin string    `json:"spark_submit_execute_bin"`
+	IsActive              bool      `json:"is_active"`
+	AuthType              AuthType  `json:"auth_type"`
+	AuthUsername          string    `json:"auth_username,omitempty"`
+	AuthPassword          string    `json:"-"` // never serialized; encrypted at rest in auth_password_enc
+	SSLVerify             bool      `json:"ssl_verify"`
+	SSLCABundle           string    `json:"ssl_ca_bundle,omitempty"`
+	URLAllowlist          []string  `json:"url_allowlist,omitempty"`
+	DefaultSubmitArgs     []string  `json:"default_submit_args,omitempty"`
+	RateLimitPerMin       int       `json:"rate_limit_per_min"`
+	CreatedAt             time.Time `json:"created_at"`
+	UpdatedAt             time.Time `json:"updated_at"`
+}