feat(auth): add opaque bearer sessions

server/src/app/core/bootstrap.py

@@ -34,7 +34,11 @@ def build_database_url(payload: BootstrapSetupPayload) -> str:
     )
 
 
-def build_bootstrap_state(settings: Settings) -> BootstrapStateRead:
+def build_bootstrap_state(
+    settings: Settings,
+    *,
+    redact_infrastructure: bool = False,
+) -> BootstrapStateRead:
     return BootstrapStateRead(
         initialized=settings.setup_completed,
         company={
@@ -46,17 +50,23 @@ def build_bootstrap_state(settings: Settings) -> BootstrapStateRead:
         server={"host": settings.app_host, "port": settings.app_port},
         database={
             "driver": "postgresql",
-            "host": settings.postgres_host,
+            "host": "" if redact_infrastructure else settings.postgres_host,
             "port": settings.postgres_port,
             "name": settings.postgres_db,
-            "username": settings.postgres_user,
+            "username": "" if redact_infrastructure else settings.postgres_user,
             "password_configured": bool(settings.postgres_password),
         },
-        redis={"enabled": bool(settings.redis_url), "url": settings.redis_url or ""},
+        redis={
+            "enabled": bool(settings.redis_url),
+            "url": "" if redact_infrastructure else settings.redis_url or "",
+        },
     )
 
 
-def persist_bootstrap_config(payload: BootstrapSetupPayload, settings: Settings) -> BootstrapStateRead:
+def persist_bootstrap_config(
+    payload: BootstrapSetupPayload,
+    settings: Settings,
+) -> BootstrapStateRead:
     env_file = ensure_env_file()
     database_url = build_database_url(payload)
     vite_api_base_url = f"http://{settings.app_host}:{settings.app_port}{settings.api_v1_prefix}"

server/src/app/core/openapi.py

@@ -9,11 +9,9 @@ X-Financial 后端 OpenAPI 文档。
 
 ## 鉴权约定
 
-- 知识库接口依赖以下请求头模拟当前用户：
-  - `X-Auth-Username`
-  - `X-Auth-Name`
-  - `X-Auth-Role-Codes`
-  - `X-Auth-Is-Admin`
+- 用户登录成功后，业务接口统一使用：
+  - `Authorization: Bearer <accessToken>`
+- 用户名、角色和管理员身份均由服务端会话与数据库目录解析，不接受浏览器自报身份。
 - Agent 资产写接口支持以下审计头：
   - `X-Actor`
   - `X-Request-Id`