feat: 完成模拟交易闭环、App 与 A 股行情接入

统一单入口 Go 工程与前端依赖目录，增加后台供应商配置、候选审核、计划预算、成交冲正、持仓复盘和站内通知。接入策略版本、Python 回测、可配置 A 股公开行情及 zap 文件轮转日志，补充迁移、契约与验证。

internal/integration/identity_account_test.go

@@ -3,8 +3,7 @@ package integration
 import (
 	"context"
 	"errors"
-	"io"
-	"log/slog"
+	"go.uber.org/zap"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -19,6 +18,7 @@ import (
 	"git.sundynix.cn/Blizzard/Veyra/internal/database"
 	"git.sundynix.cn/Blizzard/Veyra/internal/handler"
 	"git.sundynix.cn/Blizzard/Veyra/internal/repository"
+	"git.sundynix.cn/Blizzard/Veyra/internal/secret"
 	"git.sundynix.cn/Blizzard/Veyra/internal/service"
 )
 
@@ -27,7 +27,7 @@ func TestIdentityAccountLifecycle(t *testing.T) {
 	if dsn == "" {
 		t.Skip("set VEYRA_TEST_DATABASE_URL for real database integration")
 	}
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
 	admin, err := pgxpool.New(ctx, dsn)
 	if err != nil {
@@ -127,11 +127,15 @@ func TestIdentityAccountLifecycle(t *testing.T) {
 	if _, err := auth.Authenticate(ctx, login.Token, "app"); !errors.Is(err, apperror.ErrUnauthenticated) {
 		t.Fatal("expired session remained valid")
 	}
-	if _, err := auth.ProvisionUser(ctx, "admin", "an-admin-test-password", "Admin", "ADMIN"); err != nil {
+	adminUser, err := auth.ProvisionUser(ctx, "admin", "an-admin-test-password", "Admin", "ADMIN")
+	if err != nil {
 		t.Fatal(err)
 	}
+	testProviderLifecycle(t, ctx, pool, adminUser, u1)
+	vault, _ := secret.NewVault("")
+	providers := service.NewProviderService(repository.NewProviderRepository(pool), vault)
 	probe := func(context.Context) error { return nil }
-	router := handler.NewRouter(service.NewHealthService(probe, probe), slog.New(slog.NewTextHandler(io.Discard, nil)), handler.IdentityOptions{Auth: auth, Accounts: accounts, Limiter: allowLogin{}, DevelopmentLogin: true})
+	router := handler.NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), handler.IdentityOptions{Auth: auth, Providers: providers, Accounts: accounts, Limiter: allowLogin{}, DevelopmentLogin: true})
 	call := func(method, path, body, origin string, cookie *http.Cookie) *httptest.ResponseRecorder {
 		req := httptest.NewRequest(method, "http://example.com"+path, strings.NewReader(body))
 		if body != "" {
@@ -162,6 +166,23 @@ func TestIdentityAccountLifecycle(t *testing.T) {
 	if response := call(http.MethodGet, "/api/admin/v1/me", "", "", cookie); response.Code != http.StatusOK {
 		t.Fatal("cookie authentication failed")
 	}
+
+	if response := call(http.MethodGet, "/api/admin/v1/providers", "", "", nil); response.Code != http.StatusUnauthorized {
+		t.Fatal("unauthenticated configuration read allowed")
+	}
+	if response := call(http.MethodGet, "/api/admin/v1/providers", "", "", cookie); response.Code != http.StatusOK {
+		t.Fatal("admin configuration read failed")
+	}
+	body := `{"name":"","base_url":"","model_name":"","enabled":false,"timeout_seconds":15,"clear_api_key":false,"expected_version":0}`
+	if response := call(http.MethodPut, "/api/admin/v1/providers/market_primary", body, "http://attacker.example", cookie); response.Code != http.StatusForbidden {
+		t.Fatal("cross-origin configuration write allowed")
+	}
+	if response := call(http.MethodPut, "/api/admin/v1/providers/market_primary", body, "http://example.com", cookie); response.Code != http.StatusOK {
+		t.Fatal("empty market configuration write failed")
+	}
+	if response := call(http.MethodPut, "/api/admin/v1/providers/market_primary", body, "http://example.com", cookie); response.Code != http.StatusConflict {
+		t.Fatal("HTTP stale version accepted")
+	}
 	if response := call(http.MethodPost, "/api/admin/v1/auth/logout", "", "http://attacker.example", cookie); response.Code != http.StatusForbidden {
 		t.Fatal("cross-origin logout allowed")
 	}
@@ -174,6 +195,10 @@ func TestIdentityAccountLifecycle(t *testing.T) {
 	if response := call(http.MethodGet, "/api/admin/v1/me", "", "", cookie); response.Code != http.StatusUnauthorized {
 		t.Fatal("revoked admin cookie remained valid")
 	}
+	testCandidateLifecycle(t, ctx, pool, auth, adminUser, u1)
+	testStrategyBacktest(t, ctx, pool, adminUser, u1)
+	testTradeLedger(t, ctx, pool, auth)
+	testAdminCredentialChange(t, ctx, pool, auth)
 }
 
 type allowLogin struct{}