feat: 完成模拟交易闭环、App 与 A 股行情接入

统一单入口 Go 工程与前端依赖目录，增加后台供应商配置、候选审核、计划预算、成交冲正、持仓复盘和站内通知。接入策略版本、Python 回测、可配置 A 股公开行情及 zap 文件轮转日志，补充迁移、契约与验证。

internal/secret/vault_test.go

@@ -0,0 +1,43 @@
+package secret
+
+import (
+	"bytes"
+	"encoding/base64"
+	"testing"
+)
+
+func TestVaultAuthenticatedEncryption(t *testing.T) {
+	v, err := NewVault(base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{7}, 32)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	first, err := v.Encrypt("private-api-key", "model_primary")
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := v.Encrypt("private-api-key", "model_primary")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Equal(first, second) || bytes.Contains(first, []byte("private-api-key")) {
+		t.Fatal("encryption lacks nonce or exposes secret")
+	}
+	value, err := v.Decrypt(first, "model_primary")
+	if err != nil || value != "private-api-key" {
+		t.Fatal("decrypt failed")
+	}
+	if _, err := v.Decrypt(first, "model_backup"); err == nil {
+		t.Fatal("cross-configuration ciphertext accepted")
+	}
+	first[len(first)-1] ^= 1
+	if _, err := v.Decrypt(first, "model_primary"); err == nil {
+		t.Fatal("tampered ciphertext accepted")
+	}
+	empty, _ := NewVault("")
+	if _, err := empty.Encrypt("secret", "model_primary"); err == nil {
+		t.Fatal("missing master key accepted")
+	}
+	if _, err := NewVault("invalid"); err == nil {
+		t.Fatal("invalid master key accepted")
+	}
+}