feat(api): 访问日志与 HTTP/运行时指标、安全响应头与面板 CSP、跨站写拦截、请求体读截止、SSE 定期重鉴权与续传、404/405/413 信封、status 按所有权裁剪、停机并发排空

internal/api/api_test.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"sort"
@@ -1646,9 +1647,12 @@ func (okInternal) Authenticate(*http.Request) error { return nil }
 
 func newTestAPI(repo Repo, cl Cluster) *API {
 	return &API{Repo: repo, Cluster: cl, Internal: okInternal{}, RootDomain: testRoot,
-		Now: func() time.Time { return time.Unix(1_700_000_000, 0) }}
+		Now:       func() time.Time { return time.Unix(1_700_000_000, 0) },
+		AccessLog: discardLog}
 }
 
+var discardLog = slog.New(slog.NewTextHandler(io.Discard, nil))
+
 func do(h http.Handler, method, target, body string, headers map[string]string) *httptest.ResponseRecorder {
 	var r *http.Request
 	if body == "" {