fix: 修复35个安全与功能缺陷，补全知识进化/数字孪生/行为采集模块

## 安全修复 (12项)
- Webhook接口添加全局Token认证，过滤敏感请求头
- 修复JWT Base64 padding公式，防止签名验证绕过
- 数据库密码/飞书Token从源码移除，改为环境变量
- 工作流引擎添加路径遍历防护 (_resolve_safe_path)
- eval()添加模板长度上限检查
- 审批API添加认证依赖
- 前端v-html增强XSS转义，console.log仅开发模式输出
- 500错误不再暴露内部异常详情

## Agent运行时修复 (7项)
- 删除_inject_knowledge_context中未定义db变量的finally块
- 工具执行添加try/except保护，异常不崩溃Agent
- LLM重试计入budget计数器
- self_review异常时passed=False
- max_iterations截断标记success=False
- 工具参数JSON解析失败时记录警告日志
- run()开始时重置_llm_invocations计数器

## 配置与基础设施
- DEBUG默认False，SQL_ECHO独立配置项
- init_db()补全13个缺失模型导入
- 新增WEBHOOK_AUTH_TOKEN/SQL_ECHO配置项
- 新增.env.example模板文件

## 前端修复 (12项)
- 登录改用URLSearchParams替代FormData
- 401拦截器通过Pinia store统一清理状态
- SSE流超时从60s延长至300s
- final/error事件时清除streamTimeout
- localStorage聊天记录添加24h TTL
- safeParseArgCount替代模板中裸JSON.parse
- fetchUser 401时同时清除user对象

## 新增模块
- 知识进化: knowledge_extractor/retriever/tasks
- 数字孪生: shadow_executor/comparison模型
- 行为采集: behavior_middleware/collector/fingerprint_engine
- 代码审查: code_review_agent/document_review_agent
- 反馈学习: feedback_learner
- 瓶颈检测/优化引擎/成本估算/需求估算
- 速率限制器 (rate_limiter)
- Alembic迁移 015-020

## 文档
- 商业化落地计划
- 8篇docs文档 (架构/API/部署/开发/贡献等)
- Docker Compose生产配置

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/demo_digital_employee.py

@@ -18,7 +18,7 @@ import json
 import time
 import sys
 
-BASE = "http://localhost:8037"
+BASE = "http://localhost:8041"
 
 # ── 登录 ──
 def login():

scripts/startup/stop_aiagent.ps1

@@ -5,12 +5,21 @@ Write-Host "== AIAgent stop ==" -ForegroundColor Cyan
 function Get-PidsListeningOnPort([int]$Port) {
   $pids = New-Object System.Collections.Generic.HashSet[int]
   try {
-    netstat -ano | ForEach-Object {
-      $ln = $_.Trim()
-      if ($ln -notmatch "LISTENING") { return }
-      # 匹配 :8037 或 :3001 等端口后的 LISTENING 行末 PID
-      if ($ln -match ":$Port\s+.*LISTENING\s+(\d+)\s*$") {
-        [void]$pids.Add([int]$Matches[1])
+    # ForEach-Object 里写 return 会从「外层函数」返回，不能只跳过当前行。
+    foreach ($raw in (netstat -ano)) {
+      $ln = $raw.Trim()
+      if ($ln -notmatch "LISTENING") { continue }
+      $norm = $ln -replace '\s+', ' '
+      $parts = $norm.Split(' ')
+      if ($parts.Length -lt 5) { continue }
+      $local = $parts[1]
+      $ci = $local.LastIndexOf(':')
+      if ($ci -lt 0) { continue }
+      if ($local.Substring($ci + 1) -ne "$Port") { continue }
+      $pidStr = $parts[$parts.Length - 1]
+      if ($pidStr -match '^\d+$') {
+        $procId = [int]$pidStr
+        if ($procId -gt 4) { [void]$pids.Add($procId) }
       }
     }
   } catch { }
@@ -20,21 +29,21 @@ function Get-PidsListeningOnPort([int]$Port) {
 function Stop-OnPorts([int[]]$ports, [string]$name) {
   $all = New-Object System.Collections.Generic.HashSet[int]
   foreach ($p in $ports) {
-    foreach ($pid in (Get-PidsListeningOnPort $p)) {
-      [void]$all.Add($pid)
+    foreach ($listenPid in (Get-PidsListeningOnPort $p)) {
+      [void]$all.Add($listenPid)
     }
   }
   if ($all.Count -eq 0) {
     Write-Host "[SKIP] ${name}: no listener on ports $($ports -join ',')" -ForegroundColor DarkGray
     return
   }
-  foreach ($pid in $all) {
-    if ($pid -le 4) { continue }
+  foreach ($procId in $all) {
+    if ($procId -le 4) { continue }
     try {
-      Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue
-      Write-Host "[OK] stopped ${name} PID=$pid" -ForegroundColor Green
+      Stop-Process -Id $procId -Force -ErrorAction SilentlyContinue
+      Write-Host "[OK] stopped ${name} PID=$procId" -ForegroundColor Green
     } catch {
-      Write-Host "[WARN] failed to stop ${name} PID=$pid" -ForegroundColor Yellow
+      Write-Host "[WARN] failed to stop ${name} PID=$procId" -ForegroundColor Yellow
     }
   }
 }