feat(app): 实现应用 Token 校验功能

- 服务端: fetchAllConfigs 和 fetchChangedConfigs 添加 Token 校验
- 前端: 应用列表添加 Token 列和生成/删除 Token 按钮
- 客户端: Python/Node.js/Java 客户端传递 token 参数
- Java: 简化 buildTokenParameter 直接传递 token 值

server/internal/handler/config_api.go

@@ -26,6 +26,7 @@ func (h *ConfigApiHandler) FetchAllConfigs(c *gin.Context) {
 	env := c.Query("env")
 	version := c.DefaultQuery("version", "latest")
 	ignoreGlobal := c.DefaultQuery("ignoreGlobal", "false") == "true"
+	token := c.Query("token")
 
 	if appName == "" || env == "" {
 		c.JSON(http.StatusBadRequest, model.WrapperResponse{Code: 400, Msg: "参数缺失"})
@@ -40,6 +41,12 @@ func (h *ConfigApiHandler) FetchAllConfigs(c *gin.Context) {
 		return
 	}
 
+	// validate token if app has token configured
+	if app.Token != "" && app.Token != token {
+		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})
+		return
+	}
+
 	result := make(map[string]interface{})
 
 	// load global configs
@@ -101,6 +108,7 @@ type FetchChangedRequest struct {
 	LastTime     int64  `json:"lastTime" binding:"required"`
 	IgnoreGlobal bool   `json:"ignoreGlobal"`
 	FetchAll     bool   `json:"fetchAll"`
+	Token        string `json:"token"`
 }
 
 func (h *ConfigApiHandler) FetchChangedConfigs(c *gin.Context) {
@@ -117,6 +125,12 @@ func (h *ConfigApiHandler) FetchChangedConfigs(c *gin.Context) {
 		return
 	}
 
+	// validate token if app has token configured
+	if app.Token != "" && app.Token != req.Token {
+		c.JSON(http.StatusForbidden, model.WrapperResponse{Code: 403, Msg: "Token 无效"})
+		return
+	}
+
 	version := req.Version
 	if version == "" {
 		version = "latest"