feat(handler): 实现运维监控 API 处理器和中间件

- 新增 ops 错误日志记录器（ops_error_logger.go）
- 新增 ops 主处理器（ops_handler.go）
- 新增告警管理处理器（ops_alerts_handler.go）
- 新增仪表板处理器（ops_dashboard_handler.go）
- 新增实时监控处理器（ops_realtime_handler.go）
- 新增配置管理处理器（ops_settings_handler.go）
- 新增 WebSocket 处理器（ops_ws_handler.go）
- 扩展设置 DTO 支持 ops 配置
- 新增客户端请求 ID 中间件（client_request_id.go）
- 新增 WebSocket 查询令牌认证中间件（ws_query_token_auth.go）
- 更新管理员认证中间件支持 ops 路由
- 注册 handler 依赖注入

backend/internal/server/middleware/admin_auth.go

@@ -30,6 +30,20 @@ func adminAuth(
 	settingService *service.SettingService,
 ) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// WebSocket upgrade requests cannot set Authorization headers in browsers.
+		// For admin WebSocket endpoints (e.g. Ops realtime), allow passing the JWT via
+		// Sec-WebSocket-Protocol (subprotocol list) using a prefixed token item:
+		//   Sec-WebSocket-Protocol: sub2api-admin, jwt.<token>
+		if isWebSocketUpgradeRequest(c) {
+			if token := extractJWTFromWebSocketSubprotocol(c); token != "" {
+				if !validateJWTForAdmin(c, token, authService, userService) {
+					return
+				}
+				c.Next()
+				return
+			}
+		}
+
 		// 检查 x-api-key header（Admin API Key 认证）
 		apiKey := c.GetHeader("x-api-key")
 		if apiKey != "" {
@@ -58,6 +72,44 @@ func adminAuth(
 	}
 }
 
+func isWebSocketUpgradeRequest(c *gin.Context) bool {
+	if c == nil || c.Request == nil {
+		return false
+	}
+	// RFC6455 handshake uses:
+	//   Connection: Upgrade
+	//   Upgrade: websocket
+	upgrade := strings.ToLower(strings.TrimSpace(c.GetHeader("Upgrade")))
+	if upgrade != "websocket" {
+		return false
+	}
+	connection := strings.ToLower(c.GetHeader("Connection"))
+	return strings.Contains(connection, "upgrade")
+}
+
+func extractJWTFromWebSocketSubprotocol(c *gin.Context) string {
+	if c == nil {
+		return ""
+	}
+	raw := strings.TrimSpace(c.GetHeader("Sec-WebSocket-Protocol"))
+	if raw == "" {
+		return ""
+	}
+
+	// The header is a comma-separated list of tokens. We reserve the prefix "jwt."
+	// for carrying the admin JWT.
+	for _, part := range strings.Split(raw, ",") {
+		p := strings.TrimSpace(part)
+		if strings.HasPrefix(p, "jwt.") {
+			token := strings.TrimSpace(strings.TrimPrefix(p, "jwt."))
+			if token != "" {
+				return token
+			}
+		}
+	}
+	return ""
+}
+
 // validateAdminAPIKey 验证管理员 API Key
 func validateAdminAPIKey(
 	c *gin.Context,

backend/internal/server/middleware/client_request_id.go

@@ -0,0 +1,31 @@
+package middleware
+
+import (
+	"context"
+
+	"github.com/Wei-Shaw/sub2api/internal/pkg/ctxkey"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// ClientRequestID ensures every request has a unique client_request_id in request.Context().
+//
+// This is used by the Ops monitoring module for end-to-end request correlation.
+func ClientRequestID() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.Request == nil {
+			c.Next()
+			return
+		}
+
+		if v := c.Request.Context().Value(ctxkey.ClientRequestID); v != nil {
+			c.Next()
+			return
+		}
+
+		id := uuid.New().String()
+		c.Request = c.Request.WithContext(context.WithValue(c.Request.Context(), ctxkey.ClientRequestID, id))
+		c.Next()
+	}
+}
+

backend/internal/server/middleware/ws_query_token_auth.go

@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// InjectBearerTokenFromQueryForWebSocket copies `?token=` into the Authorization header
+// for WebSocket handshake requests on a small allow-list of endpoints.
+//
+// Why: browsers can't set custom headers on WebSocket handshake, but our admin routes
+// are protected by header-based auth. This keeps the token support scoped to WS only.
+func InjectBearerTokenFromQueryForWebSocket() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c == nil || c.Request == nil {
+			if c != nil {
+				c.Next()
+			}
+			return
+		}
+
+		// Only GET websocket upgrades.
+		if c.Request.Method != http.MethodGet {
+			c.Next()
+			return
+		}
+		if !strings.EqualFold(strings.TrimSpace(c.GetHeader("Upgrade")), "websocket") {
+			c.Next()
+			return
+		}
+
+		// If caller already supplied auth headers, don't override.
+		if strings.TrimSpace(c.GetHeader("Authorization")) != "" || strings.TrimSpace(c.GetHeader("x-api-key")) != "" {
+			c.Next()
+			return
+		}
+
+		// Allow-list ops websocket endpoints.
+		path := strings.TrimSpace(c.Request.URL.Path)
+		if !strings.HasPrefix(path, "/api/v1/admin/ops/ws/") {
+			c.Next()
+			return
+		}
+
+		token := strings.TrimSpace(c.Query("token"))
+		if token != "" {
+			c.Request.Header.Set("Authorization", "Bearer "+token)
+		}
+
+		c.Next()
+	}
+}