fix: 修复多个安全缺陷和功能问题

- 移除加密相关代码（服务端和所有客户端）
- 修复 JWT 验证未检查签名算法的问题
- 修复重置密码使用不安全随机数的问题
- 实现 Logout 服务端失效机制
- 修复历史版本对比 diff 颜色标记错误
- 修复占位符解析循环引用风险
- 添加用户禁用状态检查
- 更新 bug 清单文档

server/internal/handler/config.go

@@ -13,13 +13,12 @@ import (
 )
 
 type ConfigHandler struct {
-	cryptoService *service.CryptoService
 	parseService  *service.ConfigParseService
 	permService   *service.PermissionService
 }
 
-func NewConfigHandler(crypto *service.CryptoService, parse *service.ConfigParseService, perm *service.PermissionService) *ConfigHandler {
-	return &ConfigHandler{cryptoService: crypto, parseService: parse, permService: perm}
+func NewConfigHandler(parse *service.ConfigParseService, perm *service.PermissionService) *ConfigHandler {
+	return &ConfigHandler{parseService: parse, permService: perm}
 }
 
 type ConfigListRequest struct {
@@ -162,9 +161,6 @@ func (h *ConfigHandler) Add(c *gin.Context) {
 		}
 	}
 
-	// encrypt sensitive values
-	h.encryptIfRequired(&config)
-
 	if _, err := dao.Engine.Insert(&config); err != nil {
 		c.JSON(http.StatusOK, model.WrapperResponse{Code: 500, Msg: "保存失败"})
 		return
@@ -208,8 +204,6 @@ func (h *ConfigHandler) Update(c *gin.Context) {
 	now := time.Now()
 	config.UpdatedAt = &now
 
-	h.encryptIfRequired(&config)
-
 	dao.Engine.ID(config.Id).Cols("contents", "version", "updated_by", "updated_at").Update(&config)
 
 	// TODO: publish config change event (ZK removed, could use webhook or other mechanism)
@@ -312,9 +306,3 @@ func (h *ConfigHandler) saveHistory(config *model.AppConfig, operator string) {
 	}
 	dao.Engine.Insert(&history)
 }
-
-func (h *ConfigHandler) encryptIfRequired(config *model.AppConfig) {
-	// simplified: check if contents contain sensitive keys
-	// In production, parse the config and encrypt values with {Cipher} prefix
-	// For now, skip encryption logic
-}