feat(server): 安全基线（Helmet+限流+脱敏）（E10）

- 注册 @fastify/helmet（CSP 关闭）
- 引入 @fastify/rate-limit，并对 login/forgot/reset 按开关启用
- Fastify logger 增加敏感字段 redaction（authorization/cookie/password 等）

server/src/app.js

@@ -7,6 +7,8 @@ const fastify = require("fastify");
 const cors = require("@fastify/cors");
 const cookie = require("@fastify/cookie");
 const multipart = require("@fastify/multipart");
+const helmet = require("@fastify/helmet");
+const rateLimit = require("@fastify/rate-limit");
 
 const { getConfig } = require("./config");
 const authPlugin = require("./plugins/auth");
@@ -26,7 +28,20 @@ async function buildApp() {
   const config = getConfig();
 
   const app = fastify({
-    logger: true,
+    logger: {
+      redact: {
+        paths: [
+          "req.headers.authorization",
+          "req.headers.cookie",
+          "req.headers['set-cookie']",
+          "res.headers['set-cookie']",
+          "req.body.password",
+          "req.body.newPassword",
+          "req.body.code",
+        ],
+        censor: "[REDACTED]",
+      },
+    },
     trustProxy: true,
     genReqId: () => crypto.randomUUID(),
   });
@@ -60,6 +75,26 @@ async function buildApp() {
     },
   });
 
+  await app.register(helmet, {
+    contentSecurityPolicy: false,
+  });
+
+  await app.register(rateLimit, {
+    global: false,
+    errorResponseBuilder: (request, context) => {
+      return new AppError({
+        code: "SYS_429",
+        message: "请求过于频繁，请稍后重试",
+        statusCode: context.statusCode,
+        details: {
+          retryAfter: context.after,
+          max: context.max,
+          ban: context.ban,
+        },
+      });
+    },
+  });
+
   app.addHook("onRequest", async (request, reply) => {
     reply.header("x-request-id", request.id);
   });