修复: 前端审查发现的 3 项问题

1. masterVersion null 态（NodesPage + Wizard + Step2）原 'latest' 默认值会生成 releases/download/latest/... 404 URL。改为 null（拉取中）/ 空串（失败）两态： - 拉取成功：Select 显示 Master 版本 - 拉取失败：Input 要求用户手动输入版本号 - handleGenerate 前校验 agentVersion 非空 2. 批量创建 N+1 串行请求 → Promise.all 并发 + 进度条原 for 循环逐个 await createInstallToken，50 节点 N 次串行延迟。改为 Promise.all 并发，用 batchProgress state 驱动 Arco Progress 显示 "已生成 X / N 个令牌"，同时 mountedRef 保护 unmount 后不更新 state。 3. 批次内重复节点名前端预提示 spec §6.2 要求"前端去重"，此前依赖后端报错。 handleGenerate 前扫描 parseBatchNames 检测批次内重复并 Message.warning。
修复: 后端审查发现的 5 项问题
2026-08-27 11:10:38 +08:00 · 2026-04-19 17:17:08 +08:00 · 2026-04-19 17:14:17 +08:00 · 2026-04-19 16:50:30 +08:00 · 2026-04-19 16:48:54 +08:00 · 2026-04-19 16:47:03 +08:00
264 changed files with 1559 additions and 28605 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,10 +6,6 @@ on:
  pull_request:
    branches: [main, master]

-# 最小权限：构建/测试仅需读取仓库内容，显式声明以收敛默认的可写令牌。
-permissions:
-  contents: read
-
 jobs:
  backend:
    name: Go Build & Test
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -110,21 +110,13 @@ jobs:
          cp -r web/dist "${ARCHIVE_NAME}/web"
          cp server/config.example.yaml "${ARCHIVE_NAME}/"
          cp deploy/install.sh "${ARCHIVE_NAME}/" 2>/dev/null || true
-          # v2.2+: 随发布包提供 Grafana dashboard 与 nginx.conf 模板
-          if [ -d deploy/grafana ]; then
-            cp -r deploy/grafana "${ARCHIVE_NAME}/grafana"
-          fi
-          cp deploy/nginx.conf "${ARCHIVE_NAME}/nginx.conf" 2>/dev/null || true
          tar czf "${ARCHIVE_NAME}.tar.gz" "${ARCHIVE_NAME}"
-          cp "${ARCHIVE_NAME}.tar.gz" "backupx-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz"

      - name: Upload to GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.VERSION }}
-          files: |
-            backupx-${{ env.VERSION }}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
-            backupx-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
+          files: backupx-${{ env.VERSION }}-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
          generate_release_notes: true

  # ─── Job 3: Docker 多架构 → Docker Hub ───
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
 web/node_modules/
 web/dist/
-server/bin/
-.claude/
+server/bin/
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,106 +0,0 @@
-# Contributing to BackupX
-
-感谢你对 BackupX 的关注！本指南介绍如何搭建开发环境并提交贡献。
-Thanks for your interest in contributing to BackupX! This guide covers how to set up your environment and submit changes.
-
-## 开发环境 / Development Setup
-
-### 依赖 / Prerequisites
-
- **Go** 1.25+（见 `server/go.mod`）
- **Node.js** 20+（CI 与 Docker 使用 Node 20）
- **npm** 9+
-
-### 快速开始 / Quick Start
-
-分别在两个终端启动前后端（后端 :8340，前端 Vite HMR）：
-
-```bash
-git clone https://github.com/Awuqing/BackupX.git && cd BackupX
-
-# 终端 1 —— 后端（默认 http://localhost:8340）
-make dev-server
-
-# 终端 2 —— 前端（Vite 热更新，/api 代理到 8340）
-make dev-web
-```
-
-### 构建 / Building
-
-```bash
-make build          # 同时构建后端与前端
-make build-server   # 仅后端 → server/bin/backupx
-make build-web      # 仅前端 → web/dist
-make docker         # 构建 Docker 镜像
-make docker-cn      # 国内镜像源加速构建
-```
-
-> 后端会自动托管 `web/dist`（或 `server.web_root` 指定目录），因此本地裸机部署无需额外的反向代理即可访问控制台。
-
-## 测试 / Testing
-
-提交前请确保测试通过：
-
-```bash
-make test           # 后端 + 前端全部测试
-make test-server    # 仅后端：cd server && go test ./...
-make test-web       # 仅前端：cd web && npm run test（vitest）
-```
-
-新增功能或修复缺陷时，请尽量补充对应测试。
-
-## 提交信息规范 / Commit Messages
-
-本项目采用 **Conventional Commits**，正文用中文撰写：
-
-```
-<type>(<scope>): <subject>
-
-<body>
-```
-
-| type | 说明 |
-|------|------|
-| `feat` | 新功能 |
-| `fix` | 缺陷修复 |
-| `docs` | 文档变更 |
-| `style` | 不影响逻辑的格式调整 |
-| `refactor` | 重构 |
-| `perf` | 性能优化 |
-| `test` | 测试相关 |
-| `chore` | 构建/依赖/工具链 |
-
-示例：
-
-```
-feat(storage): 新增 Wasabi S3 后端支持
-fix(cluster): 修复跨节点恢复的终态处理
-docs: 补充 CONTRIBUTING 指南
-```
-
-## Pull Request 流程
-
-1. **Fork** 仓库并从最新的 `main` 切出特性分支；
-2. **开发**功能或修复，必要时补充测试；
-3. **自测**：确保 `make test` 通过；
-4. **提交**：使用上述 Conventional Commits（中文）；
-5. **推送**并对着 `main` 发起 PR。
-
-### PR 描述建议
-
- 清晰说明本 PR 做了什么；
- 对新功能/修复，补充动机与背景；
- 关联相关 Issue（如 `Closes #62`）；
- 纯文档 PR 可不附测试。
-
-> 请保持分支基于较新的 `main`：基线过旧的分支容易产生大范围冲突，难以评审与合入。
-
-## 编码规范 / Coding Conventions
-
- **Go**：所有错误必须处理（禁止 `_ = err`），日志使用项目已有库（`zap`），禁止 `fmt.Println`；提交前执行 `gofmt`。
- **前端**：遵循项目 ESLint/Prettier/tsconfig 配置，不擅自引入新的 CSS 框架或 UI 库。
- **包管理**：`web/` 使用 npm，请提交对应的 `package-lock.json`。
-
-## License
-
-向 BackupX 贡献即表示你同意你的贡献以 [Apache License 2.0](LICENSE) 授权。
--- a/README.md
+++ b/README.md
@@ -46,9 +46,6 @@
 | **Multi-Node Cluster** | Master-Agent mode via HTTP long-polling — Agents run tasks locally, upload straight to storage, no reverse connectivity required |
 | **Security** | JWT + bcrypt + AES-256-GCM encrypted config + optional backup encryption + full audit log |
 | **Notifications** | Email / Webhook / Telegram on success or failure |
-| **Observability** | Prometheus `/metrics` endpoint + `/health` + `/ready` probes + SLA breach gauge |
-| **Audit Webhook** | HMAC-SHA256 signed forwarding to SIEM / WORM storage for compliance (SOC2 / GDPR) |
-| **Flow Control** | Per-node bandwidth cap + per-node concurrency limit — tune big/small nodes independently |
 | **Deployment** | Single binary + embedded SQLite, Docker one-click, zero external dependencies |

 ## Quick Start
@@ -62,8 +59,6 @@ curl -LO https://github.com/Awuqing/BackupX/releases/latest/download/backupx-lin
 tar xzf backupx-*.tar.gz && cd backupx-* && sudo ./install.sh
 ```

-For ARM64 hosts, use `backupx-linux-arm64.tar.gz`. The archive contains `backupx`, `web/`, `config.example.yaml`, and `install.sh`; run `install.sh` from the extracted directory.
-
 Open `http://your-server:8340`, create the admin account, then follow the [5-minute Quick Start](https://awuqing.github.io/BackupX/docs/getting-started/quick-start).

 ## Documentation
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -46,9 +46,6 @@
 | **多节点集群** | Master-Agent 模式，基于 HTTP 长轮询跨多台服务器管理备份。Agent 本地执行任务并直接上传到存储，无需反向连通性 |
 | **安全** | JWT + bcrypt + AES-256-GCM 加密配置 + 可选备份文件加密 + 完整审计日志 |
 | **通知** | 邮件 / Webhook / Telegram，备份成功或失败时自动推送 |
-| **可观测性** | Prometheus `/metrics` 端点 + `/health` + `/ready` 探针 + SLA 违约监控 |
-| **审计外输** | HMAC-SHA256 签名 Webhook，对接 SIEM / WORM 存储满足 SOC2 / GDPR 合规 |
-| **流控** | 节点级带宽限速 + 节点级并发控制，大小节点分别配置，避免小内存 Agent 被挤爆 |
 | **部署** | 单二进制 + 内嵌 SQLite，Docker 一键启动，零外部依赖 |

 ## 快速开始
@@ -62,8 +59,6 @@ curl -LO https://github.com/Awuqing/BackupX/releases/latest/download/backupx-lin
 tar xzf backupx-*.tar.gz && cd backupx-* && sudo ./install.sh
 ```

-ARM64 主机请下载 `backupx-linux-arm64.tar.gz`。预编译包内包含 `backupx`、`web/`、`config.example.yaml` 和 `install.sh`，请在解压后的目录内执行 `install.sh`。
-
 打开 `http://your-server:8340`，创建管理员账户，按 [5 分钟快速开始](https://awuqing.github.io/BackupX/zh-Hans/docs/getting-started/quick-start) 完成首次备份。

 ## 文档
--- a/deploy/docker/entrypoint.sh
+++ b/deploy/docker/entrypoint.sh
@@ -1,10 +1,6 @@
 #!/bin/sh
 set -e

-if [ "${1:-}" = "agent" ]; then
-    exec /app/bin/backupx "$@"
-fi
-
 # Backend listens on internal port 8341, Nginx exposes 8340
 export BACKUPX_SERVER_PORT="${BACKUPX_SERVER_PORT_INTERNAL:-8341}"

--- a/deploy/docker/nginx.conf
+++ b/deploy/docker/nginx.conf
@@ -19,25 +19,6 @@ server {
        proxy_read_timeout 3600s;
    }

-    # Agent one-click install endpoints.
-    # Some external reverse proxies strip the /api prefix before reaching this
-    # container, so /install/ must be proxied here instead of falling through to
-    # the SPA index.html.
-    location /install/ {
-        proxy_pass http://127.0.0.1:8341/install/;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_buffering off;
-        proxy_cache off;
-    }
-
-    location = /health { proxy_pass http://127.0.0.1:8341/health; }
-    location = /ready { proxy_pass http://127.0.0.1:8341/ready; }
-    location = /metrics { proxy_pass http://127.0.0.1:8341/metrics; }
-
    # SPA fallback
    location / {
        try_files $uri $uri/ /index.html;
--- a/deploy/grafana/README.md
+++ b/deploy/grafana/README.md
@@ -1,34 +0,0 @@
-# BackupX Grafana Dashboard
-
-对接 BackupX v2.1+ 暴露的 Prometheus `/metrics` 端点。
-
-## 导入步骤
-
-1. 在 Grafana 配置 Prometheus 数据源指向你的 Prometheus（例如 `http://prometheus:9090`）
-2. 在 Prometheus 配置抓取 BackupX：
-
-```yaml
-scrape_configs:
-  - job_name: 'backupx'
-    scrape_interval: 30s
-    static_configs:
-      - targets: ['backupx-master:8340']
-```
-
-3. Grafana → Dashboards → Import → 上传 `backupx-dashboard.json` → 选 Prometheus 数据源 → Import
-
-## 面板内容
-
- 当前运行任务数 / SLA 违约数 / 在线节点 / 24h 成功率 / 应用版本
- 任务执行速率（按 success/failed 堆叠）
- 任务耗时 P50/P95/P99（按任务类型）
- 任务产出字节速率
- 存储目标用量 TopN 柱状图
- 节点在线状态表（红/绿标色）
- 验证 / 恢复 / 复制的成功率时间线
-
-## 自定义建议
-
- 将 `backupx_sla_breach_tasks > 0` 配为 AlertManager 告警
- `sum(backupx_node_online) < N` 触发集群容量告警（N 为你集群的最少节点数）
- P99 任务耗时突变可用于发现慢任务和资源压力
--- a/deploy/grafana/backupx-dashboard.json
+++ b/deploy/grafana/backupx-dashboard.json
@@ -1,193 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {"type": "grafana", "uid": "-- Grafana --"},
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "description": "BackupX v2.1+ 核心指标面板。对接 /metrics 端点，抓取周期建议 30s（与服务端 Gauge collector 同步）。",
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 1,
-  "id": null,
-  "links": [
-    {
-      "title": "BackupX 文档",
-      "url": "https://awuqing.github.io/BackupX/",
-      "type": "link",
-      "targetBlank": true
-    }
-  ],
-  "liveNow": false,
-  "panels": [
-    {
-      "type": "stat",
-      "title": "正在运行的任务",
-      "gridPos": {"h": 4, "w": 4, "x": 0, "y": 0},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "backupx_task_running", "refId": "A"}],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}, {"color": "yellow", "value": 5}]}
-        }
-      },
-      "options": {"colorMode": "value", "graphMode": "area", "textMode": "auto"}
-    },
-    {
-      "type": "stat",
-      "title": "SLA 违约任务数",
-      "gridPos": {"h": 4, "w": 4, "x": 4, "y": 0},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "backupx_sla_breach_tasks", "refId": "A"}],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "short",
-          "thresholds": {"mode": "absolute", "steps": [{"color": "green", "value": null}, {"color": "red", "value": 1}]}
-        }
-      }
-    },
-    {
-      "type": "stat",
-      "title": "在线节点",
-      "gridPos": {"h": 4, "w": 4, "x": 8, "y": 0},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "sum(backupx_node_online)", "refId": "A"}],
-      "fieldConfig": {
-        "defaults": {"unit": "short", "color": {"mode": "thresholds"}, "thresholds": {"steps": [{"color": "red", "value": null}, {"color": "green", "value": 1}]}}
-      }
-    },
-    {
-      "type": "stat",
-      "title": "24h 任务成功率",
-      "gridPos": {"h": 4, "w": 6, "x": 12, "y": 0},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{
-        "expr": "sum(rate(backupx_task_run_total{status=\"success\"}[24h])) / sum(rate(backupx_task_run_total[24h])) * 100",
-        "refId": "A"
-      }],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "percent", "decimals": 2,
-          "thresholds": {"mode": "absolute", "steps": [{"color": "red", "value": null}, {"color": "yellow", "value": 95}, {"color": "green", "value": 99}]}
-        }
-      }
-    },
-    {
-      "type": "stat",
-      "title": "应用版本",
-      "gridPos": {"h": 4, "w": 6, "x": 18, "y": 0},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "backupx_app_info", "refId": "A", "format": "table", "instant": true}],
-      "options": {"textMode": "value_and_name", "reduceOptions": {"calcs": ["last"], "fields": "/^version$/"}}
-    },
-    {
-      "type": "timeseries",
-      "title": "任务执行速率（按状态）",
-      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 4},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{
-        "expr": "sum by (status) (rate(backupx_task_run_total[5m]))",
-        "refId": "A",
-        "legendFormat": "{{status}}"
-      }],
-      "fieldConfig": {
-        "defaults": {
-          "unit": "ops",
-          "custom": {"drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 10, "stacking": {"mode": "normal"}}
-        },
-        "overrides": [
-          {"matcher": {"id": "byName", "options": "success"}, "properties": [{"id": "color", "value": {"mode": "fixed", "fixedColor": "green"}}]},
-          {"matcher": {"id": "byName", "options": "failed"}, "properties": [{"id": "color", "value": {"mode": "fixed", "fixedColor": "red"}}]}
-        ]
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "任务耗时 P50 / P95 / P99",
-      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 4},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [
-        {"expr": "histogram_quantile(0.50, sum(rate(backupx_task_run_duration_seconds_bucket[10m])) by (le, task_type))", "refId": "A", "legendFormat": "P50 {{task_type}}"},
-        {"expr": "histogram_quantile(0.95, sum(rate(backupx_task_run_duration_seconds_bucket[10m])) by (le, task_type))", "refId": "B", "legendFormat": "P95 {{task_type}}"},
-        {"expr": "histogram_quantile(0.99, sum(rate(backupx_task_run_duration_seconds_bucket[10m])) by (le, task_type))", "refId": "C", "legendFormat": "P99 {{task_type}}"}
-      ],
-      "fieldConfig": {"defaults": {"unit": "s"}}
-    },
-    {
-      "type": "timeseries",
-      "title": "任务产出字节速率",
-      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 12},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "sum by (task_type) (rate(backupx_task_bytes_total[5m]))", "refId": "A", "legendFormat": "{{task_type}}"}],
-      "fieldConfig": {"defaults": {"unit": "Bps"}}
-    },
-    {
-      "type": "bargauge",
-      "title": "存储目标用量 TopN",
-      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 12},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "topk(10, backupx_storage_used_bytes)", "refId": "A", "legendFormat": "{{target_name}} ({{target_type}})"}],
-      "fieldConfig": {"defaults": {"unit": "bytes"}},
-      "options": {"orientation": "horizontal", "displayMode": "gradient"}
-    },
-    {
-      "type": "table",
-      "title": "节点在线状态",
-      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 20},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [{"expr": "backupx_node_online", "refId": "A", "format": "table", "instant": true}],
-      "transformations": [
-        {"id": "organize", "options": {"excludeByName": {"Time": true, "__name__": true, "job": true, "instance": true}, "indexByName": {"node_name": 0, "role": 1, "Value": 2}, "renameByName": {"Value": "online"}}}
-      ],
-      "fieldConfig": {
-        "overrides": [{
-          "matcher": {"id": "byName", "options": "online"},
-          "properties": [{"id": "mappings", "value": [{"type": "value", "options": {"0": {"text": "离线", "color": "red"}, "1": {"text": "在线", "color": "green"}}}]}]
-        }]
-      }
-    },
-    {
-      "type": "timeseries",
-      "title": "验证 / 恢复 / 复制成功率",
-      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 20},
-      "datasource": {"type": "prometheus", "uid": "${DS_PROMETHEUS}"},
-      "targets": [
-        {"expr": "sum by (status) (rate(backupx_verify_run_total[15m]))", "refId": "A", "legendFormat": "verify {{status}}"},
-        {"expr": "sum by (status) (rate(backupx_restore_run_total[15m]))", "refId": "B", "legendFormat": "restore {{status}}"},
-        {"expr": "sum by (status) (rate(backupx_replication_run_total[15m]))", "refId": "C", "legendFormat": "replication {{status}}"}
-      ],
-      "fieldConfig": {"defaults": {"unit": "ops"}}
-    }
-  ],
-  "refresh": "30s",
-  "schemaVersion": 39,
-  "tags": ["backupx", "backup", "sre"],
-  "templating": {
-    "list": [
-      {
-        "current": {"selected": false, "text": "Prometheus", "value": "Prometheus"},
-        "label": "Datasource",
-        "name": "DS_PROMETHEUS",
-        "query": "prometheus",
-        "refresh": 1,
-        "regex": "",
-        "type": "datasource"
-      }
-    ]
-  },
-  "time": {"from": "now-6h", "to": "now"},
-  "timepicker": {},
-  "timezone": "",
-  "title": "BackupX Overview",
-  "uid": "backupx-overview",
-  "version": 1,
-  "weekStart": ""
-}
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -1,25 +1,17 @@
 #!/bin/sh
 set -eu

-SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-PROJECT_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+PROJECT_ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 PREFIX="${PREFIX:-/opt/backupx}"
 ETC_DIR="${ETC_DIR:-/etc/backupx}"
 SERVICE_NAME="backupx"
 APP_USER="backupx"
 APP_GROUP="backupx"
-if [ -f "$SCRIPT_DIR/backupx" ] && [ -d "$SCRIPT_DIR/web" ]; then
-    BIN_SOURCE="${BIN_SOURCE:-$SCRIPT_DIR/backupx}"
-    WEB_SOURCE="${WEB_SOURCE:-$SCRIPT_DIR/web}"
-    CONFIG_TEMPLATE="${CONFIG_TEMPLATE:-$SCRIPT_DIR/config.example.yaml}"
-    NGINX_SOURCE="${NGINX_SOURCE:-$SCRIPT_DIR/nginx.conf}"
-else
-    BIN_SOURCE="${BIN_SOURCE:-$PROJECT_ROOT/server/backupx}"
-    WEB_SOURCE="${WEB_SOURCE:-$PROJECT_ROOT/web/dist}"
-    CONFIG_TEMPLATE="${CONFIG_TEMPLATE:-$PROJECT_ROOT/server/config.example.yaml}"
-    NGINX_SOURCE="${NGINX_SOURCE:-$PROJECT_ROOT/deploy/nginx.conf}"
-fi
+BIN_SOURCE="${BIN_SOURCE:-$PROJECT_ROOT/server/backupx}"
+WEB_SOURCE="${WEB_SOURCE:-$PROJECT_ROOT/web/dist}"
+CONFIG_TEMPLATE="${CONFIG_TEMPLATE:-$PROJECT_ROOT/server/config.example.yaml}"
 SERVICE_SOURCE="${SERVICE_SOURCE:-$PROJECT_ROOT/deploy/backupx.service}"
+NGINX_SOURCE="${NGINX_SOURCE:-$PROJECT_ROOT/deploy/nginx.conf}"

 if [ "$(id -u)" -ne 0 ]; then
    echo "请使用 root 或 sudo 执行安装脚本。" >&2
@@ -28,20 +20,13 @@ fi

 if [ ! -f "$BIN_SOURCE" ]; then
    echo "未找到后端二进制：$BIN_SOURCE" >&2
-    echo "源码树安装请先执行：cd \"$PROJECT_ROOT/server\" && go build -o backupx ./cmd/backupx" >&2
-    echo "发布包安装请确认当前目录包含 ./backupx、./web 和 ./install.sh。" >&2
+    echo "请先执行：cd \"$PROJECT_ROOT/server\" && go build -o backupx ./cmd/backupx" >&2
    exit 1
 fi

 if [ ! -d "$WEB_SOURCE" ]; then
    echo "未找到前端构建产物：$WEB_SOURCE" >&2
-    echo "源码树安装请先执行：cd \"$PROJECT_ROOT/web\" && npm run build" >&2
-    echo "发布包安装请确认当前目录包含 ./web。" >&2
-    exit 1
-fi
-
-if [ ! -f "$CONFIG_TEMPLATE" ]; then
-    echo "未找到配置模板：$CONFIG_TEMPLATE" >&2
+    echo "请先执行：cd \"$PROJECT_ROOT/web\" && npm run build" >&2
    exit 1
 fi

@@ -59,40 +44,14 @@ cp -R "$WEB_SOURCE/." "$PREFIX/web/"
 chown -R "$APP_USER:$APP_GROUP" "$PREFIX"

 if [ ! -f "$ETC_DIR/config.yaml" ]; then
-    install -o "$APP_USER" -g "$APP_GROUP" -m 0640 "$CONFIG_TEMPLATE" "$ETC_DIR/config.yaml"
+    install -m 0640 "$CONFIG_TEMPLATE" "$ETC_DIR/config.yaml"
 fi
-# 确保服务账户能读取配置：历史版本曾以 root:root 0640 安装配置，
-# 导致以 backupx 身份运行的服务因无权读取配置而启动失败（exit 1）。
-chown "$APP_USER:$APP_GROUP" "$ETC_DIR/config.yaml"

-if [ -f "$SERVICE_SOURCE" ]; then
-    install -m 0644 "$SERVICE_SOURCE" "/etc/systemd/system/$SERVICE_NAME.service"
-else
-    cat > "/etc/systemd/system/$SERVICE_NAME.service" <<UNIT
-[Unit]
-Description=BackupX API Service
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=$APP_USER
-Group=$APP_GROUP
-WorkingDirectory=$PREFIX
-ExecStart=$PREFIX/bin/backupx -config $ETC_DIR/config.yaml
-Restart=on-failure
-RestartSec=5
-NoNewPrivileges=true
-LimitNOFILE=65535
-
-[Install]
-WantedBy=multi-user.target
-UNIT
-fi
+install -m 0644 "$SERVICE_SOURCE" "/etc/systemd/system/$SERVICE_NAME.service"
 systemctl daemon-reload
 systemctl enable --now "$SERVICE_NAME"

-if [ -d "/etc/nginx/conf.d" ] && [ -f "$NGINX_SOURCE" ]; then
+if [ -d "/etc/nginx/conf.d" ]; then
    install -m 0644 "$NGINX_SOURCE" "/etc/nginx/conf.d/$SERVICE_NAME.conf"
    if command -v nginx >/dev/null 2>&1; then
        nginx -t
@@ -108,14 +67,6 @@ cat <<MESSAGE
 - 配置文件：$ETC_DIR/config.yaml
 - systemd 服务：/etc/systemd/system/$SERVICE_NAME.service

-Web 控制台已由后端直接托管，无需额外的 nginx 反向代理即可访问：
-  http://<本机IP>:8340
-
-（如已安装 nginx，脚本会自动写入反向代理配置，可继续用 80 端口访问。）
-
-排查：若服务未监听端口，请查看日志：
-  journalctl -u "$SERVICE_NAME" -n 50 --no-pager
-
 如需修改监听地址、数据库路径或日志级别，请编辑 "$ETC_DIR/config.yaml" 后执行：
  systemctl restart "$SERVICE_NAME"
 MESSAGE
--- a/deploy/nginx.conf
+++ b/deploy/nginx.conf
@@ -18,22 +18,6 @@ server {
        proxy_read_timeout 3600s;
    }

-    # Agent 一键安装脚本路径（兼容 v2.0 及之前生成的命令）。
-    # v2.1+ 新生成的命令走 /api/install/... 自动命中上面的 /api/ 代理。
-    location /install/ {
-        proxy_pass http://127.0.0.1:8340/install/;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # 健康检查端点同样不走 SPA fallback。
-    location = /health { proxy_pass http://127.0.0.1:8340/health; }
-    location = /ready  { proxy_pass http://127.0.0.1:8340/ready; }
-    location = /metrics { proxy_pass http://127.0.0.1:8340/metrics; }
-
    location / {
        try_files $uri $uri/ /index.html;
    }
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,8 +22,6 @@ services:
      # - /home/user/data:/mnt/data:ro
    environment:
      - TZ=Asia/Shanghai
-      # 远程 Agent 需要通过公网或可路由地址连接 Master 时，取消注释并改成真实 URL：
-      # - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
      # 通过 BACKUPX_ 前缀环境变量覆盖配置：
      # - BACKUPX_LOG_LEVEL=debug
      # - BACKUPX_BACKUP_MAX_CONCURRENT=4
--- a/docs-site/docs/deployment/bare-metal.md
+++ b/docs-site/docs/deployment/bare-metal.md
@@ -25,19 +25,6 @@ The installer performs these steps automatically:
 4. Installs `backupx.service` (systemd), enabled at boot
 5. (Optional) installs an Nginx site file — see [Nginx Reverse Proxy](./nginx)

-For multi-node clusters, edit `/etc/backupx/config.yaml` after installation and set the Master URL that remote Agents can reach:
-
-```yaml
-server:
-  external_url: "https://backup.example.com"
-```
-
-Restart BackupX after changing it:
-
-```bash
-sudo systemctl restart backupx
-```
-
 ## From source

 ```bash
--- a/docs-site/docs/deployment/configuration.md
+++ b/docs-site/docs/deployment/configuration.md
@@ -15,14 +15,13 @@ server:
  host: "0.0.0.0"             # BACKUPX_SERVER_HOST
  port: 8340                  # BACKUPX_SERVER_PORT
  mode: "release"             # release | debug
-  external_url: ""            # BACKUPX_SERVER_EXTERNAL_URL — public Master URL for Agent install scripts

 database:
  path: "./data/backupx.db"   # BACKUPX_DATABASE_PATH — embedded SQLite

 security:
  jwt_secret: ""              # BACKUPX_SECURITY_JWT_SECRET — auto-generated if empty
-  jwt_expire: "24h"           # BACKUPX_SECURITY_JWT_EXPIRE
+  jwt_expires_in: "24h"
  encryption_key: ""          # AES-256-GCM key for storage config encryption

 backup:
@@ -47,20 +46,7 @@ The environment wins when both file and env are set. All dot-paths become unders
 | Config key | Env variable |
 |------------|--------------|
 | `server.port` | `BACKUPX_SERVER_PORT` |
-| `server.external_url` | `BACKUPX_SERVER_EXTERNAL_URL` |
-| `security.jwt_expire` | `BACKUPX_SECURITY_JWT_EXPIRE` |
 | `log.level` | `BACKUPX_LOG_LEVEL` |
 | `backup.max_concurrent` | `BACKUPX_BACKUP_MAX_CONCURRENT` |
 | `backup.temp_dir` | `BACKUPX_BACKUP_TEMP_DIR` |
 | `backup.bandwidth_limit` | `BACKUPX_BACKUP_BANDWIDTH_LIMIT` |
-
-## Master external URL
-
-Set `server.external_url` when BackupX is behind Docker, Nginx, a load balancer, or any reverse proxy whose internal Host is not reachable by remote Agents:
-
-```yaml
-server:
-  external_url: "https://backup.example.com"
-```
-
-This value is used when BackupX renders one-click Agent install scripts and docker-compose snippets. It must be reachable from every Agent host. Leave it empty only when `X-Forwarded-Proto` / `X-Forwarded-Host` are reliable and point to the same URL that Agents can access.
--- a/docs-site/docs/deployment/docker.md
+++ b/docs-site/docs/deployment/docker.md
@@ -25,8 +25,6 @@ services:
      - /etc/nginx:/mnt/nginx-conf:ro
    environment:
      - TZ=Asia/Shanghai
-      # Required when remote Agents must connect through a public or routed URL:
-      # - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
      - BACKUPX_LOG_LEVEL=info
      - BACKUPX_BACKUP_MAX_CONCURRENT=2

@@ -44,17 +42,6 @@ docker compose up -d

 To back up files from the host, mount them into the container. When creating a file-type task in the web UI, point the source path at the mount location (e.g. `/mnt/www`). Make sure the directory is visible inside the container.

-## Multi-node clusters
-
-When deploying Agents on other machines, set `BACKUPX_SERVER_EXTERNAL_URL` on the Master container to the URL that those Agents can reach:
-
-```yaml
-environment:
-  - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
-```
-
-Use an HTTPS URL if Agents cross untrusted networks. The generated one-click install scripts and docker-compose snippets use this value as `BACKUPX_AGENT_MASTER`.
-
 ## Environment variables

 All configuration keys can be overridden with the `BACKUPX_` prefix:
--- a/docs-site/docs/features/backup-types.md
+++ b/docs-site/docs/features/backup-types.md
@@ -8,8 +8,6 @@ description: File, MySQL, PostgreSQL, SQLite and SAP HANA — what they back up

 BackupX supports five built-in backup types. Type determines which runner executes the job.

-When a task is routed to a remote Agent, the source tools and paths are resolved on that Agent host. Multi-target uploads are still tracked per storage target; if at least one target succeeds, the backup record is marked successful and the per-target result table shows partial failures.
-
 ## File / Directory

 Tars (and optionally gzips) one or more filesystem paths.
--- a/docs-site/docs/features/multi-node.md
+++ b/docs-site/docs/features/multi-node.md
@@ -28,30 +28,21 @@ BackupX supports Master-Agent mode: backup tasks can be routed to specific nodes

 ## Walkthrough

-### 0. Set the Master URL for production clusters
-
-Before generating Agent install commands, make sure the Master URL shown to Agents is stable and reachable from every target host.
-
-If BackupX runs behind Docker, Nginx, a load balancer, or an outer reverse proxy, configure `server.external_url` or `BACKUPX_SERVER_EXTERNAL_URL` on the Master:
-
-```yaml title="config.yaml"
-server:
-  external_url: "https://backup.example.com"
-```
-
-This URL is baked into systemd units, foreground commands, and docker-compose snippets. If it is wrong, Agents will install successfully but stay offline because they keep polling an internal or browser-only address.
-
 ### 1. Open the install wizard

 In the Web Console → **Node Management** → **Add Node**. You'll see a three-step wizard.

 - **Step 1 — Node info.** Give the node a name, or switch to batch mode and paste multiple names (one per line, max 50).
 - **Step 2 — Deploy options.** Pick install mode (`systemd` recommended, `docker`, or `foreground` for debugging), architecture (auto-detect by default), agent version (defaults to the master's version), TTL for the install link (5 min / 15 min / 1 h / 24 h), and download source (`github` direct, or the `ghproxy` mirror for mainland China).
- **Step 3 — Copy the command.** A one-line install command is shown with a live countdown. Click copy, paste into the target machine, and run with root privileges. The default command embeds the rendered installer, so the target host does not need to fetch `/api/install/:token` through your reverse proxy. The public install URL is still available as a fallback.
+- **Step 3 — Copy the command.** A single `curl ... | sudo sh` line is shown with a live countdown. Click copy, paste into the target machine, and run with root privileges.

 ### 2. One-line install on the target host

-Use the command generated by the Web Console. It writes the installer to a temporary file, validates the `BACKUPX_AGENT_INSTALL_V1` marker, then runs it with root privileges.
+Example (systemd mode):
+
+```bash
+curl -fsSL https://master.example.com/install/Xk3p9...vM | sudo sh
+```

 The script runs automatically and:

@@ -62,10 +53,6 @@ The script runs automatically and:
 5. Runs `systemctl enable --now backupx-agent`
 6. Polls `/api/v1/agent/self` until the master confirms `status: online` (up to 30 s)

-Docker mode uses the same `BACKUPX_AGENT_MASTER`, `BACKUPX_AGENT_TOKEN`, and `BACKUPX_AGENT_TEMP_DIR=/var/lib/backupx-agent/tmp` environment contract. After starting the container, the installer also probes `/api/v1/agent/self`; if the node does not come online, it prints `docker ps` and `docker logs --tail=100 backupx-agent` diagnostics before exiting non-zero.
-
-If you choose the URL-based fallback command and `curl` prints HTML or the shell reports `Syntax error: newline unexpected`, the install URL is being served by the web console instead of the backend. Ensure either `/api/install/` or `/install/` is forwarded to the BackupX backend, or use the embedded command generated by the console.
-
 Reruns are idempotent — to upgrade or re-provision, simply generate a new install command and run it again. The one-time install link expires after its TTL or after first consumption, whichever is sooner.

 ### 3. Rotate agent tokens at any time
@@ -83,15 +70,9 @@ In the **Backup Tasks** page, pick the target node when creating the task. When
 - Local (`nodeId=0`) → Master executes in-process
 - Remote node → Master enqueues the command → Agent claims → Agent runs locally → uploads → reports back

-The node table shows the Agent health and command queue state: pending/dispatched depth, running long commands, timeouts, oldest active command age, and the latest Agent-side error. The same queue depth, running-command, and timeout snapshots are exported as Prometheus metrics:
-
- `backupx_agent_command_queue_depth`
- `backupx_agent_command_running`
- `backupx_agent_command_timeout_total`
-
 ## Known limitations

- **Encrypted backups are Master-only** — the Agent doesn't hold Master's AES-256 key. Creating or updating a task with `encrypt: true` and a remote node or node pool is rejected up front
+- **Encrypted backups don't work via Agent** — the Agent doesn't hold Master's AES-256 key. Tasks with `encrypt: true` will fail if routed to an Agent
 - **Directory browser timeout** — remote dir listing is a synchronous RPC through the queue (15s default)
 - **Dispatched command timeout** — claimed-but-unfinished commands are marked `timeout` after 10 minutes

--- a/docs-site/docs/getting-started/quick-start.md
+++ b/docs-site/docs/getting-started/quick-start.md
@@ -42,8 +42,6 @@ Go to **Backup Tasks → New**. Three steps:
 2. **Source** — paths for file backup (multi-source supported), or connection info for databases
 3. **Storage & policy** — pick target(s), compression, retention days, encryption on/off

-For Agent-routed tasks, encryption must stay off because the Agent never receives the Master's encryption key. BackupX rejects remote-node or node-pool tasks with encryption enabled during create/update.
-
 Save, then click **Run Now** to trigger a test. Live logs stream on the **Backup Records** page.

 :::note
--- a/docs-site/docusaurus.config.ts
+++ b/docs-site/docusaurus.config.ts
@@ -6,7 +6,7 @@ import type * as Preset from '@docusaurus/preset-classic';
 // https://awuqing.github.io/BackupX/
 const config: Config = {
  title: 'BackupX',
-  tagline: 'Self-hosted backup orchestration for servers, databases, storage targets and remote agents',
+  tagline: 'Self-hosted server backup management — one binary, one command',
  favicon: 'img/favicon.ico',

  future: {
@@ -76,16 +76,6 @@ const config: Config = {
          label: 'Downloads',
          position: 'left',
        },
-        {
-          to: '/community',
-          label: 'Community',
-          position: 'left',
-        },
-        {
-          to: '/sponsors',
-          label: 'Sponsors',
-          position: 'left',
-        },
        {
          type: 'localeDropdown',
          position: 'right',
@@ -125,22 +115,6 @@ const config: Config = {
            {label: 'Issues', href: 'https://github.com/Awuqing/BackupX/issues'},
          ],
        },
-        {
-          title: 'Community',
-          items: [
-            {label: 'Contributors', href: 'https://github.com/Awuqing/BackupX/graphs/contributors'},
-            {label: 'Pull Requests', href: 'https://github.com/Awuqing/BackupX/pulls'},
-            {label: 'Sponsor', to: '/sponsors'},
-          ],
-        },
-        {
-          title: 'Sponsors',
-          items: [
-            {label: 'Sponsor BackupX', href: 'https://github.com/sponsors/Awuqing'},
-            {label: 'Partnership', href: 'https://github.com/Awuqing/BackupX/issues/new/choose'},
-            {label: 'Sponsor tiers', to: '/sponsors'},
-          ],
-        },
      ],
      copyright: `Copyright © ${new Date().getFullYear()} BackupX · Apache License 2.0`,
    },
--- a/docs-site/i18n/zh-CN/code.json
+++ b/docs-site/i18n/zh-CN/code.json
@@ -1,22 +1,22 @@
 {
  "home.badge": {
-    "message": "开源备份控制平面 · v2.2.1",
+    "message": "开源 · v1.6.0",
    "description": "Version badge on the hero"
  },
  "home.title.part1": {
-    "message": "面向自托管服务器的",
+    "message": "为每一台服务器提供",
    "description": "Hero title, first line"
  },
  "home.title.part2": {
-    "message": "备份编排平台。",
+    "message": "自托管备份管理。",
    "description": "Hero title accent second line"
  },
  "home.tagline": {
-    "message": "在一个清爽控制台中管理文件、数据库、SAP HANA 和远程节点备份。控制平面自己掌握，存储后端灵活选择。",
+    "message": "一个二进制，一条命令。文件 / 数据库 / SAP HANA 备份直送 70+ 存储后端。",
    "description": "Tagline on the home page"
  },
  "home.pageTitle": {
-    "message": "面向自托管服务器的备份编排",
+    "message": "自托管备份管理",
    "description": "Page <title> element on the home page"
  },
  "home.getStarted": {
@@ -28,26 +28,13 @@
    "description": "Hero metric label: storage backends"
  },
  "home.metric.backupTypes": {
-    "message": "远程执行",
+    "message": "备份类型",
    "description": "Hero metric label: backup types"
  },
  "home.metric.license": {
    "message": "开源协议",
    "description": "Hero metric label: license"
  },
-  "home.visual.eyebrow": {"message": "BackupX 控制台"},
-  "home.visual.title": {"message": "运维概览"},
-  "home.visual.status": {"message": "健康"},
-  "home.visual.success": {"message": "成功率"},
-  "home.visual.nodes": {"message": "活跃节点"},
-  "home.visual.targets": {"message": "存储目标"},
-  "home.visual.row1.title": {"message": "PostgreSQL 夜间备份"},
-  "home.visual.row1.desc": {"message": "加密归档已上传至 S3"},
-  "home.visual.row2.title": {"message": "SAP HANA 快照"},
-  "home.visual.row2.desc": {"message": "正在 agent-shanghai-02 上运行"},
-  "home.visual.row3.title": {"message": "保留策略清理"},
-  "home.visual.row3.desc": {"message": "下一次执行在 4 小时后"},
-  "home.command.title": {"message": "使用 Docker 启动"},

  "section.features.tag": {
    "message": "核心能力",
@@ -91,70 +78,5 @@
  "showcase.storage.desc": {"message": "阿里云 OSS、腾讯云 COS、S3、Google Drive、WebDAV — 加上每一种 rclone 后端。测试连接、收藏、查看实时容量。"},
  "showcase.nodes.title": {"message": "几分钟搭起 Master-Agent"},
  "showcase.nodes.desc": {"message": "创建节点、复制令牌、在任意远程主机启动 Agent。路由到节点的任务在本地执行并直接上传到存储 — 无需反向连通性。"},
-  "showcase.cta": {"message": "开始阅读文档"},
-
-  "community.tag": {"message": "社区"},
-  "community.pageTitle": {"message": "社区、赞助商与贡献者"},
-  "community.pageDescription": {"message": "赞助 BackupX，了解贡献者，并找到务实的参与方式。"},
-  "community.title": {"message": "开放协作，面向长期运维"},
-  "community.subtitle": {"message": "备份软件的信任来自透明发布、真实部署反馈，以及足够务实的贡献路径。"},
-  "community.sponsor.kicker": {"message": "赞助商"},
-  "community.sponsor.wallTitle": {"message": "赞助商"},
-  "community.sponsor.title": {"message": "支持你依赖的备份基础设施"},
-  "community.sponsor.cta": {"message": "赞助 BackupX"},
-  "community.sponsor.openSlot": {"message": "赞助席位开放"},
-  "community.sponsor.logo.project": {"message": "项目赞助"},
-  "community.sponsor.logo.cloud": {"message": "云服务伙伴"},
-  "community.sponsor.logo.object": {"message": "对象存储"},
-  "community.sponsor.logo.cdn": {"message": "CDN 伙伴"},
-  "community.sponsor.logo.database": {"message": "数据库伙伴"},
-  "community.sponsor.logo.security": {"message": "安全审计"},
-  "community.sponsor.logo.agent": {"message": "远程节点实验室"},
-  "community.sponsor.logo.docs": {"message": "文档赞助"},
-  "community.sponsor.logo.release": {"message": "发布赞助"},
-  "community.sponsor.logo.s3": {"message": "S3 兼容"},
-  "community.sponsor.logo.webdav": {"message": "WebDAV 伙伴"},
-  "community.sponsor.logo.sftp": {"message": "SFTP 伙伴"},
-  "community.sponsor.logo.docker": {"message": "容器伙伴"},
-  "community.sponsor.logo.mirror": {"message": "镜像伙伴"},
-  "community.sponsor.logo.restore": {"message": "恢复演练"},
-  "community.sponsor.logo.qa": {"message": "测试实验室"},
-  "community.sponsor.logo.oss": {"message": "开源支持"},
-  "community.sponsor.logo.open": {"message": "赞助席位开放"},
-  "community.sponsor.infrastructure.label": {"message": "基础设施"},
-  "community.sponsor.infrastructure.title": {"message": "云与存储生态伙伴"},
-  "community.sponsor.infrastructure.desc": {"message": "帮助 BackupX 覆盖对象存储、WebDAV、SFTP 以及区域云平台的真实验证。"},
-  "community.sponsor.security.label": {"message": "安全"},
-  "community.sponsor.security.title": {"message": "审计与可靠性支持者"},
-  "community.sponsor.security.desc": {"message": "支持加密、恢复演练、发布签名和运维检查等强化工作。"},
-  "community.sponsor.community.label": {"message": "社区"},
-  "community.sponsor.community.title": {"message": "开源支持者"},
-  "community.sponsor.community.desc": {"message": "支持文档、示例、平台测试和贡献者引导。"},
-  "community.sponsor.tier.backer.name": {"message": "Backer"},
-  "community.sponsor.tier.backer.amount": {"message": "适合个人与小团队"},
-  "community.sponsor.tier.backer.desc": {"message": "支持文档、Issue 分流、兼容性测试和小型体验改进。"},
-  "community.sponsor.tier.partner.name": {"message": "Partner"},
-  "community.sponsor.tier.partner.amount": {"message": "适合存储与基础设施厂商"},
-  "community.sponsor.tier.partner.desc": {"message": "支持 Provider 验证、部署示例、基准说明和集成指南。"},
-  "community.sponsor.tier.enterprise.name": {"message": "Enterprise"},
-  "community.sponsor.tier.enterprise.amount": {"message": "适合生产环境使用方"},
-  "community.sponsor.tier.enterprise.desc": {"message": "赞助恢复演练、发布加固、审计和长期维护等可靠性工作。"},
-  "community.contributor.kicker": {"message": "贡献者"},
-  "community.contributor.all": {"message": "查看全部"},
-  "community.contributor.source": {"message": "浏览器端通过 GitHub contributors API 获取。"},
-  "community.contributor.botRole": {"message": "自动化贡献者"},
-  "community.contributor.githubRole": {"message": "GitHub 贡献者"},
-  "community.contributor.contributions": {"message": "{count} 次贡献"},
-  "community.path.kicker": {"message": "贡献路径"},
-  "community.path.issues.title": {"message": "反馈生产问题"},
-  "community.path.issues.desc": {"message": "提交日志、部署拓扑和恢复预期。"},
-  "community.path.docs.title": {"message": "完善文档与示例"},
-  "community.path.docs.desc": {"message": "贡献存储、Agent 和数据库部署指南。"},
-  "community.path.code.title": {"message": "提交聚焦的 PR"},
-  "community.path.code.desc": {"message": "保持改动小而可测，并贴合现有架构。"},
-  "sponsors.pageTitle": {"message": "赞助商"},
-  "sponsors.pageDescription": {"message": "赞助 BackupX 的可靠性、文档、存储兼容性和长期维护。"},
-  "sponsors.tag": {"message": "赞助商"},
-  "sponsors.title": {"message": "赞助 BackupX 生态"},
-  "sponsors.subtitle": {"message": "赞助帮助 BackupX 更贴近真实运维：经过验证的存储 Provider、可靠发布、恢复信心和更完善的文档。"}
+  "showcase.cta": {"message": "开始阅读文档"}
 }
--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/bare-metal.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/bare-metal.md
@@ -25,19 +25,6 @@ sudo ./install.sh
 4. 安装并启用 `backupx.service` systemd 单元
 5. （可选）生成 Nginx 站点配置 — 参见 [Nginx 反向代理](./nginx)

-如果要部署多节点集群，安装后请编辑 `/etc/backupx/config.yaml`，设置远程 Agent 可访问到的 Master URL：
-
-```yaml
-server:
-  external_url: "https://backup.example.com"
-```
-
-修改后重启 BackupX：
-
-```bash
-sudo systemctl restart backupx
-```
-
 ## 从源码构建

 ```bash
--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/configuration.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/configuration.md
@@ -15,14 +15,13 @@ server:
  host: "0.0.0.0"             # BACKUPX_SERVER_HOST
  port: 8340                  # BACKUPX_SERVER_PORT
  mode: "release"             # release | debug
-  external_url: ""            # BACKUPX_SERVER_EXTERNAL_URL — Agent 安装脚本使用的 Master 对外 URL

 database:
  path: "./data/backupx.db"   # BACKUPX_DATABASE_PATH — 内嵌 SQLite

 security:
  jwt_secret: ""              # BACKUPX_SECURITY_JWT_SECRET — 留空自动生成
-  jwt_expire: "24h"           # BACKUPX_SECURITY_JWT_EXPIRE
+  jwt_expires_in: "24h"
  encryption_key: ""          # 用于加密存储配置的 AES-256-GCM 密钥

 backup:
@@ -47,20 +46,7 @@ log:
 | 配置项 | 环境变量 |
 |--------|----------|
 | `server.port` | `BACKUPX_SERVER_PORT` |
-| `server.external_url` | `BACKUPX_SERVER_EXTERNAL_URL` |
-| `security.jwt_expire` | `BACKUPX_SECURITY_JWT_EXPIRE` |
 | `log.level` | `BACKUPX_LOG_LEVEL` |
 | `backup.max_concurrent` | `BACKUPX_BACKUP_MAX_CONCURRENT` |
 | `backup.temp_dir` | `BACKUPX_BACKUP_TEMP_DIR` |
 | `backup.bandwidth_limit` | `BACKUPX_BACKUP_BANDWIDTH_LIMIT` |
-
-## Master 对外 URL
-
-当 BackupX 部署在 Docker、Nginx、负载均衡或多层反向代理后面，且后端收到的内部 Host 不是远程 Agent 可访问地址时，请配置 `server.external_url`：
-
-```yaml
-server:
-  external_url: "https://backup.example.com"
-```
-
-BackupX 会用这个地址渲染一键 Agent 安装脚本和 docker-compose 片段。该地址必须能被所有 Agent 主机访问。只有在 `X-Forwarded-Proto` / `X-Forwarded-Host` 可靠且正好指向 Agent 可访问地址时，才建议留空。
--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/docker.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/deployment/docker.md
@@ -25,8 +25,6 @@ services:
      - /etc/nginx:/mnt/nginx-conf:ro
    environment:
      - TZ=Asia/Shanghai
-      # 远程 Agent 需要通过公网或可路由地址连接 Master 时必须配置：
-      # - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
      - BACKUPX_LOG_LEVEL=info
      - BACKUPX_BACKUP_MAX_CONCURRENT=2

@@ -44,17 +42,6 @@ docker compose up -d

 想备份宿主机上的文件，需要将对应路径挂载进容器。在 Web UI 创建文件类型任务时，把源路径指向挂载后的容器内路径（如 `/mnt/www`）。

-## 多节点集群
-
-如果要在其他机器部署 Agent，请在 Master 容器上设置 `BACKUPX_SERVER_EXTERNAL_URL`，值为所有 Agent 都能访问到的 URL：
-
-```yaml
-environment:
-  - BACKUPX_SERVER_EXTERNAL_URL=https://backup.example.com
-```
-
-Agent 跨不可信网络访问时建议使用 HTTPS。控制台生成的一键安装脚本和 docker-compose 片段会把这个值写成 `BACKUPX_AGENT_MASTER`。
-
 ## 环境变量

 所有配置项都可以通过 `BACKUPX_` 前缀环境变量覆盖：
--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/features/backup-types.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/features/backup-types.md
@@ -8,8 +8,6 @@ description: 文件、MySQL、PostgreSQL、SQLite 和 SAP HANA — 各自的能

 BackupX 支持五种内置备份类型，类型决定了用哪个 runner 执行。

-当任务路由到远程 Agent 时，源路径和外部工具都会在该 Agent 主机上解析。多存储目标上传仍会逐目标记录结果；只要至少一个目标上传成功，备份记录即为成功，详情中的目标结果表会展示部分失败。
-
 ## 文件 / 目录

 打包（可选 gzip）一个或多个文件系统路径。
--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/features/multi-node.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/features/multi-node.md
@@ -28,30 +28,21 @@ BackupX 支持 Master-Agent 模式：备份任务可以指定在哪个节点执

 ## 一键部署步骤

-### 0. 为生产集群设置 Master 对外 URL
-
-生成 Agent 安装命令前，请先确认 Master URL 对所有目标主机稳定可达。
-
-如果 BackupX 部署在 Docker、Nginx、负载均衡或外层反向代理后面，请在 Master 配置 `server.external_url` 或环境变量 `BACKUPX_SERVER_EXTERNAL_URL`：
-
-```yaml title="config.yaml"
-server:
-  external_url: "https://backup.example.com"
-```
-
-该 URL 会写入 systemd 单元、前台运行命令和 docker-compose 片段。如果地址不正确，Agent 可能安装成功但始终离线，因为它会持续轮询一个内网地址或仅浏览器可访问的地址。
-
 ### 1. 打开安装向导

 Web 控制台 → **节点管理** → **添加节点**，打开三步向导：

 - **第一步 · 节点信息**：填写节点名称；或切换"批量创建"粘贴多行名称（每行一个，最多 50 个）
 - **第二步 · 部署参数**：选择安装模式（`systemd` 推荐、`Docker`、`前台运行` 调试用）、架构（默认自动检测）、Agent 版本（默认跟随 Master 版本）、有效期（5 分钟 / 15 分钟 / 1 小时 / 24 小时）、下载源（`GitHub` 直连或 `ghproxy` 镜像，国内服务器建议后者）
- **第三步 · 安装命令**：一条一键安装命令 + 实时倒计时。点击复制，粘贴到目标机以 root 权限执行。默认命令会嵌入已渲染的安装脚本，目标机无需再通过反向代理访问 `/api/install/:token`；公开安装 URL 仍作为备用路径保留。
+- **第三步 · 安装命令**：一行 `curl ... | sudo sh` 命令 + 实时倒计时。点击复制，粘贴到目标机以 root 权限执行

 ### 2. 目标机一条命令完成

-请直接使用 Web 控制台生成的命令。该命令会把安装脚本写入临时文件，校验 `BACKUPX_AGENT_INSTALL_V1` 魔数，再以 root 权限执行。
+示例（systemd 模式）：
+
+```bash
+curl -fsSL https://master.example.com/install/Xk3p9...vM | sudo sh
+```

 脚本会自动：

@@ -62,10 +53,6 @@ Web 控制台 → **节点管理** → **添加节点**，打开三步向导：
 5. 执行 `systemctl enable --now backupx-agent`
 6. 轮询 `/api/v1/agent/self`，直到 Master 确认 `status: online`（最多 30 秒）

-Docker 模式使用同一组环境变量约定：`BACKUPX_AGENT_MASTER`、`BACKUPX_AGENT_TOKEN` 和 `BACKUPX_AGENT_TEMP_DIR=/var/lib/backupx-agent/tmp`。容器启动后，安装脚本同样会探测 `/api/v1/agent/self`；如果节点没有上线，会输出 `docker ps` 与 `docker logs --tail=100 backupx-agent` 排查命令，并以非零状态退出。
-
-如果使用 URL 备用命令时 `curl` 输出 HTML，或 shell 报 `Syntax error: newline unexpected`，说明安装 URL 被 Web 控制台接管而不是转发到后端。需要确保 `/api/install/` 或 `/install/` 至少一个路径能转发到 BackupX 后端，或改用控制台生成的嵌入式命令。
-
 脚本是幂等的：升级或重装只需重新生成一条安装命令再跑一次。一次性安装链接在 TTL 到期或被首次消费后立即作废。

 ### 3. 随时轮换 Agent Token
@@ -83,15 +70,9 @@ Docker 模式使用同一组环境变量约定：`BACKUPX_AGENT_MASTER`、`BACKU
 - 本机 / 未指定（`nodeId=0`）：Master 进程内直接执行
 - 远程节点：Master 写入命令队列 → Agent 拉取 → Agent 本地执行 → 上传 → 回报

-节点列表会展示 Agent 健康与命令队列状态：pending/dispatched 深度、运行中的长任务、超时数、最旧活跃命令年龄和最近 Agent 错误。同样的队列深度、运行中命令数和超时快照会导出为 Prometheus 指标：
-
- `backupx_agent_command_queue_depth`
- `backupx_agent_command_running`
- `backupx_agent_command_timeout_total`
-
 ## 已知限制

- **加密备份仅支持 Master 本机执行**：Agent 不持有 Master 的 AES-256 密钥。创建或更新任务时，如果 `encrypt: true` 且选择了远程节点或节点池，会在入口直接拒绝
+- **Agent 不支持加密备份**：Agent 不持有 Master 的 AES-256 密钥。`encrypt: true` 的任务路由到 Agent 时会直接上报失败
 - **目录浏览超时**：远程目录浏览通过命令队列做同步 RPC，默认 15s 超时
 - **派发命令超时**：Agent 领取但未完成的命令超过 10 分钟会被置 `timeout`

--- a/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/getting-started/quick-start.md
+++ b/docs-site/i18n/zh-CN/docusaurus-plugin-content-docs/current/getting-started/quick-start.md
@@ -42,8 +42,6 @@ description: 部署 BackupX、添加存储目标、创建第一个备份任务
 2. **源配置** — 文件备份选择源路径（支持多个），数据库备份填写连接信息
 3. **存储与策略** — 选择存储目标（支持多个）、压缩策略、保留天数、是否加密

-对于路由到 Agent 的任务，加密必须关闭，因为 Agent 不会拿到 Master 的加密密钥。BackupX 会在创建/更新阶段拒绝开启加密的远程节点或节点池任务。
-
 保存后可点击 **立即执行** 测试，**备份记录** 页面实时查看执行日志。

 :::note
--- a/docs-site/i18n/zh-CN/docusaurus-theme-classic/footer.json
+++ b/docs-site/i18n/zh-CN/docusaurus-theme-classic/footer.json
@@ -2,8 +2,6 @@
  "link.title.Docs": {"message": "文档"},
  "link.title.Features": {"message": "功能"},
  "link.title.More": {"message": "更多"},
-  "link.title.Community": {"message": "社区"},
-  "link.title.Sponsors": {"message": "赞助商"},
  "link.item.label.Introduction": {"message": "简介"},
  "link.item.label.Quick Start": {"message": "快速开始"},
  "link.item.label.Installation": {"message": "安装"},
@@ -13,11 +11,5 @@
  "link.item.label.GitHub": {"message": "GitHub"},
  "link.item.label.Releases": {"message": "Releases"},
  "link.item.label.Docker Hub": {"message": "Docker Hub"},
-  "link.item.label.Issues": {"message": "Issues"},
-  "link.item.label.Contributors": {"message": "贡献者"},
-  "link.item.label.Pull Requests": {"message": "Pull Requests"},
-  "link.item.label.Sponsor": {"message": "赞助"},
-  "link.item.label.Sponsor BackupX": {"message": "赞助 BackupX"},
-  "link.item.label.Partnership": {"message": "合作伙伴"},
-  "link.item.label.Sponsor tiers": {"message": "赞助层级"}
+  "link.item.label.Issues": {"message": "Issues"}
 }
--- a/docs-site/i18n/zh-CN/docusaurus-theme-classic/navbar.json
+++ b/docs-site/i18n/zh-CN/docusaurus-theme-classic/navbar.json
@@ -7,14 +7,6 @@
    "message": "下载",
    "description": "Navbar item: Downloads"
  },
-  "item.label.Community": {
-    "message": "社区",
-    "description": "Navbar item: Community"
-  },
-  "item.label.Sponsors": {
-    "message": "赞助商",
-    "description": "Navbar item: Sponsors"
-  },
  "item.label.GitHub": {
    "message": "GitHub",
    "description": "Navbar item: GitHub"
--- a/docs-site/package-lock.json
+++ b/docs-site/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "docs-site-tmp",
-  "version": "1.0.0",
+  "version": "0.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "docs-site-tmp",
-      "version": "1.0.0",
+      "version": "0.0.0",
      "dependencies": {
        "@docusaurus/core": "3.10.0",
        "@docusaurus/faster": "3.10.0",
@@ -164,6 +164,7 @@
      "resolved": "https://registry.npmmirror.com/@algolia/client-search/-/client-search-5.50.2.tgz",
      "integrity": "sha512-ypSboUJ3XJoQz5DeDo82hCnrRuwq3q9ZdFhVKAik9TnZh1DvLqoQsrbBjXg7C7zQOtV/Qbge/HmyoV6V5L7MhQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@algolia/client-common": "5.50.2",
        "@algolia/requester-browser-xhr": "5.50.2",
@@ -262,12 +263,12 @@
      }
    },
    "node_modules/@babel/code-frame": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
-      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmmirror.com/@babel/code-frame/-/code-frame-7.29.0.tgz",
+      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
      "license": "MIT",
      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.28.5",
        "js-tokens": "^4.0.0",
        "picocolors": "^1.1.1"
      },
@@ -289,6 +290,7 @@
      "resolved": "https://registry.npmmirror.com/@babel/core/-/core-7.29.0.tgz",
      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.29.0",
        "@babel/generator": "^7.29.0",
@@ -324,13 +326,13 @@
      }
    },
    "node_modules/@babel/generator": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
-      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
+      "version": "7.29.1",
+      "resolved": "https://registry.npmmirror.com/@babel/generator/-/generator-7.29.1.tgz",
+      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
      "license": "MIT",
      "dependencies": {
-        "@babel/parser": "^7.29.7",
-        "@babel/types": "^7.29.7",
+        "@babel/parser": "^7.29.0",
+        "@babel/types": "^7.29.0",
        "@jridgewell/gen-mapping": "^0.3.12",
        "@jridgewell/trace-mapping": "^0.3.28",
        "jsesc": "^3.0.2"
@@ -449,9 +451,9 @@
      }
    },
    "node_modules/@babel/helper-globals": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
-      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
+      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
      "license": "MIT",
      "engines": {
        "node": ">=6.9.0"
@@ -471,27 +473,27 @@
      }
    },
    "node_modules/@babel/helper-module-imports": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
-      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
+      "version": "7.28.6",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
+      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
      "license": "MIT",
      "dependencies": {
-        "@babel/traverse": "^7.29.7",
-        "@babel/types": "^7.29.7"
+        "@babel/traverse": "^7.28.6",
+        "@babel/types": "^7.28.6"
      },
      "engines": {
        "node": ">=6.9.0"
      }
    },
    "node_modules/@babel/helper-module-transforms": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
-      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
+      "version": "7.28.6",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
+      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
      "license": "MIT",
      "dependencies": {
-        "@babel/helper-module-imports": "^7.29.7",
-        "@babel/helper-validator-identifier": "^7.29.7",
-        "@babel/traverse": "^7.29.7"
+        "@babel/helper-module-imports": "^7.28.6",
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/traverse": "^7.28.6"
      },
      "engines": {
        "node": ">=6.9.0"
@@ -513,9 +515,9 @@
      }
    },
    "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
-      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
+      "version": "7.28.6",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
+      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
      "license": "MIT",
      "engines": {
        "node": ">=6.9.0"
@@ -569,18 +571,18 @@
      }
    },
    "node_modules/@babel/helper-string-parser": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
-      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "version": "7.27.1",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
      "license": "MIT",
      "engines": {
        "node": ">=6.9.0"
      }
    },
    "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
-      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "version": "7.28.5",
+      "resolved": "https://registry.npmmirror.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
      "license": "MIT",
      "engines": {
        "node": ">=6.9.0"
@@ -623,12 +625,12 @@
      }
    },
    "node_modules/@babel/parser": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
-      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+      "version": "7.29.2",
+      "resolved": "https://registry.npmmirror.com/@babel/parser/-/parser-7.29.2.tgz",
+      "integrity": "sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==",
      "license": "MIT",
      "dependencies": {
-        "@babel/types": "^7.29.7"
+        "@babel/types": "^7.29.0"
      },
      "bin": {
        "parser": "bin/babel-parser.js"
@@ -1213,15 +1215,15 @@
      }
    },
    "node_modules/@babel/plugin-transform-modules-systemjs": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.7.tgz",
-      "integrity": "sha512-TM2ZcQLoG2/y4HODiStCo10DibYhWhGWAwVv+EQKmG/7GFl0N+AAmUiXOMKM+aiJ9XBJ9AHVZBvTzMnJ2sM3cQ==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmmirror.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.0.tgz",
+      "integrity": "sha512-PrujnVFbOdUpw4UHiVwKvKRLMMic8+eC0CuNlxjsyZUiBjhFdPsewdXCkveh2KqBA9/waD0W1b4hXSOBQJezpQ==",
      "license": "MIT",
      "dependencies": {
-        "@babel/helper-module-transforms": "^7.29.7",
-        "@babel/helper-plugin-utils": "^7.29.7",
-        "@babel/helper-validator-identifier": "^7.29.7",
-        "@babel/traverse": "^7.29.7"
+        "@babel/helper-module-transforms": "^7.28.6",
+        "@babel/helper-plugin-utils": "^7.28.6",
+        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/traverse": "^7.29.0"
      },
      "engines": {
        "node": ">=6.9.0"
@@ -1918,31 +1920,31 @@
      }
    },
    "node_modules/@babel/template": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
-      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
+      "version": "7.28.6",
+      "resolved": "https://registry.npmmirror.com/@babel/template/-/template-7.28.6.tgz",
+      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
      "license": "MIT",
      "dependencies": {
-        "@babel/code-frame": "^7.29.7",
-        "@babel/parser": "^7.29.7",
-        "@babel/types": "^7.29.7"
+        "@babel/code-frame": "^7.28.6",
+        "@babel/parser": "^7.28.6",
+        "@babel/types": "^7.28.6"
      },
      "engines": {
        "node": ">=6.9.0"
      }
    },
    "node_modules/@babel/traverse": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
-      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmmirror.com/@babel/traverse/-/traverse-7.29.0.tgz",
+      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
      "license": "MIT",
      "dependencies": {
-        "@babel/code-frame": "^7.29.7",
-        "@babel/generator": "^7.29.7",
-        "@babel/helper-globals": "^7.29.7",
-        "@babel/parser": "^7.29.7",
-        "@babel/template": "^7.29.7",
-        "@babel/types": "^7.29.7",
+        "@babel/code-frame": "^7.29.0",
+        "@babel/generator": "^7.29.0",
+        "@babel/helper-globals": "^7.28.0",
+        "@babel/parser": "^7.29.0",
+        "@babel/template": "^7.28.6",
+        "@babel/types": "^7.29.0",
        "debug": "^4.3.1"
      },
      "engines": {
@@ -1950,13 +1952,13 @@
      }
    },
    "node_modules/@babel/types": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
-      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmmirror.com/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
      "license": "MIT",
      "dependencies": {
-        "@babel/helper-string-parser": "^7.29.7",
-        "@babel/helper-validator-identifier": "^7.29.7"
+        "@babel/helper-string-parser": "^7.27.1",
+        "@babel/helper-validator-identifier": "^7.28.5"
      },
      "engines": {
        "node": ">=6.9.0"
@@ -2079,6 +2081,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=18"
      },
@@ -2101,6 +2104,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=18"
      }
@@ -2210,6 +2214,7 @@
      "resolved": "https://registry.npmmirror.com/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "cssesc": "^3.0.0",
        "util-deprecate": "^1.0.2"
@@ -2631,6 +2636,7 @@
      "resolved": "https://registry.npmmirror.com/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "cssesc": "^3.0.0",
        "util-deprecate": "^1.0.2"
@@ -3543,6 +3549,7 @@
      "resolved": "https://registry.npmmirror.com/@docusaurus/faster/-/faster-3.10.0.tgz",
      "integrity": "sha512-GNPtVH14ISjHfSwnHu3KiFGf86ICmJSQDeSv/QaanpBgiZGOtgZaslnC5q8WiguxM1EVkwcGxPuD8BXF4eggKw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@docusaurus/types": "3.10.0",
        "@rspack/core": "^1.7.10",
@@ -3673,6 +3680,7 @@
      "resolved": "https://registry.npmmirror.com/@docusaurus/plugin-content-docs/-/plugin-content-docs-3.10.0.tgz",
      "integrity": "sha512-9BjHhf15ct8Z7TThTC0xRndKDVvMKmVsAGAN7W9FpNRzfMdScOGcXtLmcCWtJGvAezjOJIm6CxOYCy3Io5+RnQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@docusaurus/core": "3.10.0",
        "@docusaurus/logger": "3.10.0",
@@ -4704,6 +4712,7 @@
      "resolved": "https://registry.npmmirror.com/@mdx-js/react/-/react-3.1.1.tgz",
      "integrity": "sha512-f++rKLQgUVYDAtECQ6fn/is15GkEH9+nZPM3MS0RcxVqoTfawHvDlSCH7JbMhAM6uJ32v3eXLvLmLvjGu7PTQw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/mdx": "^2.0.0"
      },
@@ -5408,6 +5417,7 @@
      "resolved": "https://registry.npmmirror.com/@svgr/core/-/core-8.1.0.tgz",
      "integrity": "sha512-8QqtOQT5ACVlmsvKOJNEaWmRPmcojMOzCz4Hs2BGG/toAp/K38LcsMRyLp349glq5AzJbCEeimEoxaX6v/fLrA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/core": "^7.21.3",
        "@svgr/babel-preset": "8.1.0",
@@ -5512,6 +5522,7 @@
      "integrity": "sha512-tglZGyx8N5PC+x1Nd/JrZxqpqlcZoSuG9gTDKO6AuFToFiVB3uS8HvbKFuO7g3lJzvFf9riAb94xs9HU2UhAHQ==",
      "hasInstallScript": true,
      "license": "Apache-2.0",
+      "peer": true,
      "dependencies": {
        "@swc/counter": "^0.1.3",
        "@swc/types": "^0.1.26"
@@ -6236,6 +6247,7 @@
      "resolved": "https://registry.npmmirror.com/@types/react/-/react-19.2.14.tgz",
      "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "csstype": "^3.2.2"
      }
@@ -6577,6 +6589,7 @@
      "resolved": "https://registry.npmmirror.com/acorn/-/acorn-8.16.0.tgz",
      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
      "license": "MIT",
+      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -6644,6 +6657,7 @@
      "resolved": "https://registry.npmmirror.com/ajv/-/ajv-8.18.0.tgz",
      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.3",
        "fast-uri": "^3.0.1",
@@ -6689,6 +6703,7 @@
      "resolved": "https://registry.npmmirror.com/algoliasearch/-/algoliasearch-5.50.2.tgz",
      "integrity": "sha512-Tfp26yoNWurUjfgK4GOrVJQhSNXu9tJtHfFFNosgT2YClG+vPyUjX/gbC8rG39qLncnZg8Fj34iarQWpMkqefw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@algolia/abtesting": "1.16.2",
        "@algolia/client-abtesting": "5.50.2",
@@ -7042,9 +7057,9 @@
      }
    },
    "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.4",
+      "resolved": "https://registry.npmmirror.com/body-parser/-/body-parser-1.20.4.tgz",
+      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
      "license": "MIT",
      "dependencies": {
        "bytes": "~3.1.2",
@@ -7055,7 +7070,7 @@
        "http-errors": "~2.0.1",
        "iconv-lite": "~0.4.24",
        "on-finished": "~2.4.1",
-        "qs": "~6.15.1",
+        "qs": "~6.14.0",
        "raw-body": "~2.5.3",
        "type-is": "~1.6.18",
        "unpipe": "~1.0.0"
@@ -7067,7 +7082,7 @@
    },
    "node_modules/body-parser/node_modules/bytes": {
      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "resolved": "https://registry.npmmirror.com/bytes/-/bytes-3.1.2.tgz",
      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
      "license": "MIT",
      "engines": {
@@ -7076,7 +7091,7 @@
    },
    "node_modules/body-parser/node_modules/debug": {
      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "resolved": "https://registry.npmmirror.com/debug/-/debug-2.6.9.tgz",
      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
      "license": "MIT",
      "dependencies": {
@@ -7085,7 +7100,7 @@
    },
    "node_modules/body-parser/node_modules/ms": {
      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "resolved": "https://registry.npmmirror.com/ms/-/ms-2.0.0.tgz",
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
      "license": "MIT"
    },
@@ -7168,6 +7183,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.10.12",
        "caniuse-lite": "^1.0.30001782",
@@ -7826,7 +7842,7 @@
    },
    "node_modules/content-type": {
      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "resolved": "https://registry.npmmirror.com/content-type/-/content-type-1.0.5.tgz",
      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
      "license": "MIT",
      "engines": {
@@ -8134,6 +8150,7 @@
      "resolved": "https://registry.npmmirror.com/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "cssesc": "^3.0.0",
        "util-deprecate": "^1.0.2"
@@ -9263,14 +9280,14 @@
      }
    },
    "node_modules/express": {
-      "version": "4.22.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
-      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "version": "4.22.1",
+      "resolved": "https://registry.npmmirror.com/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
      "license": "MIT",
      "dependencies": {
        "accepts": "~1.3.8",
        "array-flatten": "1.1.1",
-        "body-parser": "~1.20.5",
+        "body-parser": "~1.20.3",
        "content-disposition": "~0.5.4",
        "content-type": "~1.0.4",
        "cookie": "~0.7.1",
@@ -9289,7 +9306,7 @@
        "parseurl": "~1.3.3",
        "path-to-regexp": "~0.1.12",
        "proxy-addr": "~2.0.7",
-        "qs": "~6.15.1",
+        "qs": "~6.14.0",
        "range-parser": "~1.2.1",
        "safe-buffer": "5.2.1",
        "send": "~0.19.0",
@@ -9397,9 +9414,9 @@
      "license": "MIT"
    },
    "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
      "funding": [
        {
          "type": "github",
@@ -9507,6 +9524,7 @@
      "resolved": "https://registry.npmmirror.com/ajv/-/ajv-6.14.0.tgz",
      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -10553,7 +10571,7 @@
    },
    "node_modules/iconv-lite": {
      "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "resolved": "https://registry.npmmirror.com/iconv-lite/-/iconv-lite-0.4.24.tgz",
      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
      "license": "MIT",
      "dependencies": {
@@ -12051,7 +12069,7 @@
    },
    "node_modules/media-typer": {
      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "resolved": "https://registry.npmmirror.com/media-typer/-/media-typer-0.3.0.tgz",
      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
      "license": "MIT",
      "engines": {
@@ -14186,6 +14204,7 @@
      "resolved": "https://registry.npmmirror.com/ajv/-/ajv-6.14.0.tgz",
      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -14241,7 +14260,7 @@
    },
    "node_modules/object-inspect": {
      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "resolved": "https://registry.npmmirror.com/object-inspect/-/object-inspect-1.13.4.tgz",
      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
      "license": "MIT",
      "engines": {
@@ -14700,9 +14719,9 @@
      }
    },
    "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.10",
+      "resolved": "https://registry.npmmirror.com/postcss/-/postcss-8.5.10.tgz",
+      "integrity": "sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==",
      "funding": [
        {
          "type": "opencollective",
@@ -14718,6 +14737,7 @@
        }
      ],
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "nanoid": "^3.3.11",
        "picocolors": "^1.1.1",
@@ -15621,6 +15641,7 @@
      "resolved": "https://registry.npmmirror.com/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "cssesc": "^3.0.0",
        "util-deprecate": "^1.0.2"
@@ -16314,9 +16335,9 @@
      }
    },
    "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.14.2",
+      "resolved": "https://registry.npmmirror.com/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
      "license": "BSD-3-Clause",
      "dependencies": {
        "side-channel": "^1.1.0"
@@ -16380,7 +16401,7 @@
    },
    "node_modules/raw-body": {
      "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "resolved": "https://registry.npmmirror.com/raw-body/-/raw-body-2.5.3.tgz",
      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
      "license": "MIT",
      "dependencies": {
@@ -16395,7 +16416,7 @@
    },
    "node_modules/raw-body/node_modules/bytes": {
      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "resolved": "https://registry.npmmirror.com/bytes/-/bytes-3.1.2.tgz",
      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
      "license": "MIT",
      "engines": {
@@ -16437,6 +16458,7 @@
      "resolved": "https://registry.npmmirror.com/react/-/react-19.2.5.tgz",
      "integrity": "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA==",
      "license": "MIT",
+      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
@@ -16446,6 +16468,7 @@
      "resolved": "https://registry.npmmirror.com/react-dom/-/react-dom-19.2.5.tgz",
      "integrity": "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "scheduler": "^0.27.0"
      },
@@ -16501,6 +16524,7 @@
      "resolved": "https://registry.npmmirror.com/@docusaurus/react-loadable/-/react-loadable-6.0.0.tgz",
      "integrity": "sha512-YMMxTUQV/QFSnbgrP3tjDzLHRg7vsbMn8e9HAa8o/1iXoiomo48b7sk/kkmWEuWNDPJVlKSJRB6Y2fHqdJk+SQ==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/react": "*"
      },
@@ -16529,6 +16553,7 @@
      "resolved": "https://registry.npmmirror.com/react-router/-/react-router-5.3.4.tgz",
      "integrity": "sha512-Ys9K+ppnJah3QuaRiLxk+jDWOR1MekYQrlytiXxC1RyfbdsZkS5pvKAzCCr031xHixZwpnsYNT5xysdFHQaYsA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@babel/runtime": "^7.12.13",
        "history": "^4.9.0",
@@ -17204,7 +17229,7 @@
    },
    "node_modules/safer-buffer": {
      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "resolved": "https://registry.npmmirror.com/safer-buffer/-/safer-buffer-2.1.2.tgz",
      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
      "license": "MIT"
    },
@@ -17575,7 +17600,7 @@
    },
    "node_modules/side-channel": {
      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "resolved": "https://registry.npmmirror.com/side-channel/-/side-channel-1.1.0.tgz",
      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
      "license": "MIT",
      "dependencies": {
@@ -17594,7 +17619,7 @@
    },
    "node_modules/side-channel-list": {
      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "resolved": "https://registry.npmmirror.com/side-channel-list/-/side-channel-list-1.0.1.tgz",
      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
      "license": "MIT",
      "dependencies": {
@@ -17610,7 +17635,7 @@
    },
    "node_modules/side-channel-map": {
      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "resolved": "https://registry.npmmirror.com/side-channel-map/-/side-channel-map-1.0.1.tgz",
      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
      "license": "MIT",
      "dependencies": {
@@ -17628,7 +17653,7 @@
    },
    "node_modules/side-channel-weakmap": {
      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "resolved": "https://registry.npmmirror.com/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
      "license": "MIT",
      "dependencies": {
@@ -18303,7 +18328,8 @@
      "version": "2.8.1",
      "resolved": "https://registry.npmmirror.com/tslib/-/tslib-2.8.1.tgz",
      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
+      "license": "0BSD",
+      "peer": true
    },
    "node_modules/tsyringe": {
      "version": "4.10.0",
@@ -18337,7 +18363,7 @@
    },
    "node_modules/type-is": {
      "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "resolved": "https://registry.npmmirror.com/type-is/-/type-is-1.6.18.tgz",
      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
      "license": "MIT",
      "dependencies": {
@@ -18350,7 +18376,7 @@
    },
    "node_modules/type-is/node_modules/mime-db": {
      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "resolved": "https://registry.npmmirror.com/mime-db/-/mime-db-1.52.0.tgz",
      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
      "license": "MIT",
      "engines": {
@@ -18359,7 +18385,7 @@
    },
    "node_modules/type-is/node_modules/mime-types": {
      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "resolved": "https://registry.npmmirror.com/mime-types/-/mime-types-2.1.35.tgz",
      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
      "license": "MIT",
      "dependencies": {
@@ -18384,6 +18410,7 @@
      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
      "devOptional": true,
      "license": "Apache-2.0",
+      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -18725,6 +18752,7 @@
      "resolved": "https://registry.npmmirror.com/ajv/-/ajv-6.14.0.tgz",
      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "fast-deep-equal": "^3.1.1",
        "fast-json-stable-stringify": "^2.0.0",
@@ -18923,6 +18951,7 @@
      "resolved": "https://registry.npmmirror.com/webpack/-/webpack-5.106.2.tgz",
      "integrity": "sha512-wGN3qcrBQIFmQ/c0AiOAQBvrZ5lmY8vbbMv4Mxfgzqd/B6+9pXtLo73WuS1dSGXM5QYY3hZnIbvx+K1xxe6FyA==",
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "@types/eslint-scope": "^3.7.7",
        "@types/estree": "^1.0.8",
@@ -19064,9 +19093,9 @@
      }
    },
    "node_modules/webpack-dev-server": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-5.2.4.tgz",
-      "integrity": "sha512-GqDPGZN9bRqKBTkp4aWkobDDHMsrXKoGSdOH56smIri8qR0JG8gfL8/v/f/OZR3/OKXjG8uwJbFVhKm/FNU/UA==",
+      "version": "5.2.3",
+      "resolved": "https://registry.npmmirror.com/webpack-dev-server/-/webpack-dev-server-5.2.3.tgz",
+      "integrity": "sha512-9Gyu2F7+bg4Vv+pjbovuYDhHX+mqdqITykfzdM9UyKqKHlsE5aAjRhR+oOEfXW5vBeu8tarzlJFIZva4ZjAdrQ==",
      "license": "MIT",
      "dependencies": {
        "@types/bonjour": "^3.5.13",
--- a/docs-site/src/components/HomepageCommunity/index.tsx
+++ b/docs-site/src/components/HomepageCommunity/index.tsx
@@ -1,329 +0,0 @@
-import type {ReactNode} from 'react';
-import {useEffect, useState} from 'react';
-import Heading from '@theme/Heading';
-import Translate from '@docusaurus/Translate';
-import Link from '@docusaurus/Link';
-import styles from './styles.module.css';
-
-type SponsorSlot = {
-  brand: ReactNode;
-  name: ReactNode;
-  href?: string;
-};
-
-type Contributor = {
-  login: string;
-  avatarUrl?: string;
-  contributions: number;
-  type: string;
-  href: string;
-};
-
-type GitHubContributor = {
-  login: string;
-  avatar_url?: string;
-  contributions?: number;
-  html_url?: string;
-  type?: string;
-};
-
-type CommunityPath = {
-  title: ReactNode;
-  description: ReactNode;
-  href: string;
-};
-
-const SPONSOR_SLOTS: SponsorSlot[] = [
-  {
-    brand: 'BackupX',
-    name: <Translate id="community.sponsor.logo.project">Project backer</Translate>,
-    href: 'https://github.com/sponsors/Awuqing',
-  },
-  {
-    brand: 'Cloud',
-    name: <Translate id="community.sponsor.logo.cloud">Cloud partner</Translate>,
-  },
-  {
-    brand: 'Object',
-    name: <Translate id="community.sponsor.logo.object">Object storage</Translate>,
-  },
-  {
-    brand: 'CDN',
-    name: <Translate id="community.sponsor.logo.cdn">CDN partner</Translate>,
-  },
-  {
-    brand: 'DB',
-    name: <Translate id="community.sponsor.logo.database">Database partner</Translate>,
-  },
-  {
-    brand: 'Security',
-    name: <Translate id="community.sponsor.logo.security">Security audit</Translate>,
-  },
-  {
-    brand: 'Agent',
-    name: <Translate id="community.sponsor.logo.agent">Remote node lab</Translate>,
-  },
-  {
-    brand: 'Docs',
-    name: <Translate id="community.sponsor.logo.docs">Docs sponsor</Translate>,
-  },
-  {
-    brand: 'Release',
-    name: <Translate id="community.sponsor.logo.release">Release sponsor</Translate>,
-  },
-  {
-    brand: 'S3',
-    name: <Translate id="community.sponsor.logo.s3">S3 compatible</Translate>,
-  },
-  {
-    brand: 'WebDAV',
-    name: <Translate id="community.sponsor.logo.webdav">WebDAV partner</Translate>,
-  },
-  {
-    brand: 'SFTP',
-    name: <Translate id="community.sponsor.logo.sftp">SFTP partner</Translate>,
-  },
-  {
-    brand: 'Docker',
-    name: <Translate id="community.sponsor.logo.docker">Container partner</Translate>,
-  },
-  {
-    brand: 'Mirror',
-    name: <Translate id="community.sponsor.logo.mirror">Mirror partner</Translate>,
-  },
-  {
-    brand: 'Restore',
-    name: <Translate id="community.sponsor.logo.restore">Restore drill</Translate>,
-  },
-  {
-    brand: 'QA',
-    name: <Translate id="community.sponsor.logo.qa">Test lab</Translate>,
-  },
-  {
-    brand: 'OSS',
-    name: <Translate id="community.sponsor.logo.oss">Open source</Translate>,
-  },
-  {
-    brand: 'Open Slot',
-    name: <Translate id="community.sponsor.logo.open">Sponsor slot open</Translate>,
-  },
-];
-
-const FALLBACK_CONTRIBUTORS: Contributor[] = [
-  {
-    login: 'Awuqing',
-    contributions: 0,
-    type: 'User',
-    href: 'https://github.com/Awuqing',
-  },
-  {
-    login: 'dependabot[bot]',
-    contributions: 0,
-    type: 'Bot',
-    href: 'https://github.com/dependabot',
-  },
-];
-
-const COMMUNITY_PATHS: CommunityPath[] = [
-  {
-    title: <Translate id="community.path.issues.title">Report production issues</Translate>,
-    description: <Translate id="community.path.issues.desc">Share logs, deployment topology and restore expectations.</Translate>,
-    href: 'https://github.com/Awuqing/BackupX/issues',
-  },
-  {
-    title: <Translate id="community.path.docs.title">Improve docs and examples</Translate>,
-    description: <Translate id="community.path.docs.desc">Contribute deployment guides for storage, agents and databases.</Translate>,
-    href: '/docs/development/contributing',
-  },
-  {
-    title: <Translate id="community.path.code.title">Ship focused PRs</Translate>,
-    description: <Translate id="community.path.code.desc">Keep changes small, tested and aligned with the existing architecture.</Translate>,
-    href: 'https://github.com/Awuqing/BackupX/pulls',
-  },
-];
-
-function SponsorLogoCard({brand, name, href}: SponsorSlot) {
-  return (
-    <Link className={styles.sponsorLogoTile} to={href ?? 'https://github.com/sponsors/Awuqing'}>
-      <span className={styles.sponsorLogoMark}>{brand}</span>
-      <span className={styles.sponsorLogoName}>{name}</span>
-    </Link>
-  );
-}
-
-function getInitials(login: string): string {
-  return login
-    .replace(/\[bot\]$/i, '')
-    .split(/[-_\s]/)
-    .filter(Boolean)
-    .slice(0, 2)
-    .map(part => part[0]?.toUpperCase())
-    .join('') || login.slice(0, 2).toUpperCase();
-}
-
-function normalizeContributor(contributor: GitHubContributor): Contributor | null {
-  if (!contributor.login) {
-    return null;
-  }
-  return {
-    login: contributor.login,
-    avatarUrl: contributor.avatar_url,
-    contributions: contributor.contributions ?? 0,
-    type: contributor.type ?? 'User',
-    href: contributor.html_url ?? `https://github.com/${contributor.login}`,
-  };
-}
-
-function useGitHubContributors(): Contributor[] {
-  const [contributors, setContributors] = useState<Contributor[]>(FALLBACK_CONTRIBUTORS);
-
-  useEffect(() => {
-    const controller = new AbortController();
-
-    fetch('https://api.github.com/repos/Awuqing/BackupX/contributors?per_page=12', {
-      signal: controller.signal,
-      headers: {
-        Accept: 'application/vnd.github+json',
-      },
-    })
-      .then(response => {
-        if (!response.ok) {
-          throw new Error(`GitHub contributors request failed: ${response.status}`);
-        }
-        return response.json() as Promise<GitHubContributor[]>;
-      })
-      .then(payload => {
-        const nextContributors = payload
-          .map(normalizeContributor)
-          .filter((contributor): contributor is Contributor => Boolean(contributor));
-
-        if (nextContributors.length > 0) {
-          setContributors(nextContributors);
-        }
-      })
-      .catch(error => {
-        if (error instanceof Error && error.name !== 'AbortError') {
-          console.warn(error.message);
-        }
-      });
-
-    return () => controller.abort();
-  }, []);
-
-  return contributors;
-}
-
-function ContributorCard({login, avatarUrl, contributions, type, href}: Contributor) {
-  return (
-    <Link className={styles.contributorCard} to={href}>
-      {avatarUrl ? (
-        <img className={styles.avatarImage} src={avatarUrl} alt="" loading="lazy" />
-      ) : (
-        <span className={styles.avatar} aria-hidden="true">{getInitials(login)}</span>
-      )}
-      <span className={styles.contributorBody}>
-        <strong>{login}</strong>
-        <span>
-          {type === 'Bot' ? (
-            <Translate id="community.contributor.botRole">Automation contributor</Translate>
-          ) : (
-            <Translate id="community.contributor.githubRole">GitHub contributor</Translate>
-          )}
-        </span>
-        <em>
-          <Translate id="community.contributor.contributions" values={{count: contributions}}>
-            {'{count} contributions'}
-          </Translate>
-        </em>
-      </span>
-    </Link>
-  );
-}
-
-export function HomepageSponsors(): ReactNode {
-  return (
-    <div className={styles.sponsorWall}>
-      <div className={styles.sponsorWallHeader}>
-        <Heading as="h3" className={styles.sponsorWallTitle}>
-          <Translate id="community.sponsor.wallTitle">Sponsors</Translate>
-        </Heading>
-        <Link className={styles.sponsorWallAction} to="https://github.com/sponsors/Awuqing">
-          <Translate id="community.sponsor.cta">Sponsor BackupX</Translate>
-          <span aria-hidden="true">-&gt;</span>
-        </Link>
-      </div>
-
-      <div className={styles.sponsorLogoGrid}>
-        {SPONSOR_SLOTS.map((slot, index) => (
-          <SponsorLogoCard key={index} {...slot} />
-        ))}
-      </div>
-    </div>
-  );
-}
-
-export default function HomepageCommunity(): ReactNode {
-  const contributors = useGitHubContributors();
-
-  return (
-    <section id="community" className={styles.section}>
-      <div className="container">
-        <div className={styles.sectionHead}>
-          <div className={styles.sectionTag}>
-            <Translate id="community.tag">COMMUNITY</Translate>
-          </div>
-          <Heading as="h2" className={styles.sectionTitle}>
-            <Translate id="community.title">Built in the open, ready for long-term operators</Translate>
-          </Heading>
-          <p className={styles.sectionSubtitle}>
-            <Translate id="community.subtitle">
-              Backup software earns trust through transparent releases, real deployment feedback and a contributor path that stays practical.
-            </Translate>
-          </p>
-        </div>
-
-        <HomepageSponsors />
-
-        <div className={styles.communityGrid}>
-          <div className={styles.panel}>
-            <div className={styles.panelHeader}>
-              <span>
-                <Translate id="community.contributor.kicker">Contributors</Translate>
-              </span>
-              <Link to="https://github.com/Awuqing/BackupX/graphs/contributors">
-                <Translate id="community.contributor.all">View all</Translate>
-              </Link>
-            </div>
-            <div className={styles.panelNote}>
-              <Translate id="community.contributor.source">Loaded from GitHub contributors API in the browser.</Translate>
-            </div>
-            <div className={styles.contributorList}>
-              {contributors.map(contributor => (
-                <ContributorCard key={contributor.login} {...contributor} />
-              ))}
-            </div>
-          </div>
-
-          <div className={styles.panel}>
-            <div className={styles.panelHeader}>
-              <span>
-                <Translate id="community.path.kicker">Contributor paths</Translate>
-              </span>
-            </div>
-            <div className={styles.pathList}>
-              {COMMUNITY_PATHS.map((path, index) => (
-                <Link key={index} className={styles.pathItem} to={path.href}>
-                  <span className={styles.pathIndex}>{String(index + 1).padStart(2, '0')}</span>
-                  <span>
-                    <strong>{path.title}</strong>
-                    <em>{path.description}</em>
-                  </span>
-                </Link>
-              ))}
-            </div>
-          </div>
-        </div>
-      </div>
-    </section>
-  );
-}
--- a/docs-site/src/components/HomepageCommunity/styles.module.css
+++ b/docs-site/src/components/HomepageCommunity/styles.module.css
@@ -1,429 +0,0 @@
-.section {
-  padding: 5.5rem 0 6rem;
-  background:
-    linear-gradient(180deg, rgba(245, 247, 250, 0) 0%, rgba(245, 247, 250, 0.86) 100%),
-    var(--ifm-background-color);
-}
-
-[data-theme='dark'] .section {
-  background:
-    linear-gradient(180deg, rgba(15, 17, 21, 0) 0%, rgba(255, 255, 255, 0.03) 100%),
-    var(--ifm-background-color);
-}
-
-.sectionHead {
-  max-width: 760px;
-  margin: 0 auto 2.5rem;
-  text-align: center;
-}
-
-.sectionTag {
-  display: inline-flex;
-  align-items: center;
-  min-height: 28px;
-  margin-bottom: 1rem;
-  padding: 4px 10px;
-  color: #00a870;
-  background: rgba(0, 180, 42, 0.1);
-  border: 1px solid rgba(0, 180, 42, 0.18);
-  border-radius: 8px;
-  font-size: 12px;
-  font-weight: 750;
-  letter-spacing: 0;
-}
-
-.sectionTitle {
-  margin: 0 0 1rem;
-  color: var(--ifm-heading-color);
-  font-size: 2.35rem;
-  font-weight: 750;
-  letter-spacing: 0;
-  line-height: 1.2;
-}
-
-.sectionSubtitle {
-  margin: 0;
-  color: var(--ifm-color-content-secondary);
-  font-size: 1.04rem;
-  line-height: 1.7;
-}
-
-.sponsorWall {
-  overflow: hidden;
-  margin-bottom: 1rem;
-  background: var(--ifm-background-color);
-  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
-  box-shadow: 0 12px 28px rgba(29, 33, 41, 0.06);
-}
-
-[data-theme='dark'] .sponsorWall {
-  background: rgba(255, 255, 255, 0.02);
-  border-color: rgba(255, 255, 255, 0.08);
-  box-shadow: none;
-}
-
-.sponsorWallHeader {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  min-height: 60px;
-  padding: 0 1.25rem;
-  border-bottom: 1px solid var(--ifm-color-emphasis-200);
-}
-
-[data-theme='dark'] .sponsorWallHeader {
-  border-bottom-color: rgba(255, 255, 255, 0.08);
-}
-
-.sponsorWallTitle {
-  position: relative;
-  margin: 0;
-  padding-left: 14px;
-  color: var(--ifm-heading-color);
-  font-size: 1.05rem;
-  font-weight: 750;
-  letter-spacing: 0;
-}
-
-.sponsorWallTitle::before {
-  position: absolute;
-  top: 50%;
-  left: 0;
-  width: 3px;
-  height: 18px;
-  content: "";
-  background: #52c41a;
-  border-radius: 3px;
-  transform: translateY(-50%);
-}
-
-.sponsorWallAction {
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  min-height: 36px;
-  padding: 0 12px;
-  color: #52c41a;
-  background: rgba(82, 196, 26, 0.08);
-  border: 1px solid rgba(82, 196, 26, 0.2);
-  border-radius: 8px;
-  font-size: 13px;
-  font-weight: 700;
-  text-decoration: none !important;
-  white-space: nowrap;
-  transition: background 0.2s ease, border-color 0.2s ease, transform 0.2s ease;
-}
-
-.sponsorWallAction:hover,
-.sponsorWallAction:focus-visible {
-  color: #389e0d;
-  background: rgba(82, 196, 26, 0.14);
-  border-color: #52c41a;
-  transform: translateY(-1px);
-}
-
-.sponsorLogoGrid {
-  display: grid;
-  grid-template-columns: repeat(6, minmax(0, 1fr));
-  background: var(--ifm-color-emphasis-200);
-  gap: 1px;
-  padding: 1px;
-}
-
-[data-theme='dark'] .sponsorLogoGrid {
-  background: rgba(255, 255, 255, 0.08);
-}
-
-.sponsorLogoTile {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  min-width: 0;
-  min-height: 106px;
-  padding: 14px 10px;
-  flex-direction: column;
-  color: inherit;
-  background: var(--ifm-background-color);
-  text-align: center;
-  text-decoration: none !important;
-  transition: background 0.2s ease, box-shadow 0.2s ease, transform 0.2s ease;
-}
-
-[data-theme='dark'] .sponsorLogoTile {
-  background: rgba(15, 17, 21, 0.78);
-}
-
-.sponsorLogoTile:hover,
-.sponsorLogoTile:focus-visible {
-  z-index: 1;
-  color: inherit;
-  background: rgba(82, 196, 26, 0.04);
-  box-shadow: inset 0 0 0 1px rgba(82, 196, 26, 0.5);
-  transform: translateY(-1px);
-}
-
-.sponsorLogoMark {
-  display: block;
-  max-width: 100%;
-  overflow-wrap: anywhere;
-  color: var(--ifm-color-primary);
-  font-size: 1.45rem;
-  font-weight: 850;
-  letter-spacing: 0;
-  line-height: 1.1;
-}
-
-.sponsorLogoTile:nth-child(2n) .sponsorLogoMark {
-  color: #ff7d00;
-}
-
-.sponsorLogoTile:nth-child(3n) .sponsorLogoMark {
-  color: #14c9c9;
-}
-
-.sponsorLogoTile:nth-child(4n) .sponsorLogoMark {
-  color: #722ed1;
-}
-
-.sponsorLogoTile:nth-child(5n) .sponsorLogoMark {
-  color: #52c41a;
-}
-
-.sponsorLogoName {
-  display: block;
-  max-width: 100%;
-  margin-top: 10px;
-  color: var(--ifm-color-content-secondary);
-  font-size: 0.86rem;
-  font-weight: 600;
-  line-height: 1.35;
-}
-
-.panel {
-  background: var(--ifm-background-color);
-  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
-  box-shadow: 0 12px 28px rgba(29, 33, 41, 0.06);
-}
-
-[data-theme='dark'] .panel {
-  background: rgba(255, 255, 255, 0.02);
-  border-color: rgba(255, 255, 255, 0.08);
-  box-shadow: none;
-}
-
-.communityGrid {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 1rem;
-}
-
-.panel {
-  min-width: 0;
-  padding: 1.25rem;
-}
-
-.panelHeader {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  margin-bottom: 1rem;
-  color: var(--ifm-color-content-secondary);
-  font-size: 12px;
-  font-weight: 750;
-  letter-spacing: 0;
-  text-transform: uppercase;
-}
-
-.panelHeader a {
-  color: var(--ifm-color-primary);
-  text-decoration: none !important;
-}
-
-.panelNote {
-  margin: -0.35rem 0 1rem;
-  color: var(--ifm-color-content-secondary);
-  font-size: 0.82rem;
-  line-height: 1.5;
-}
-
-.contributorList,
-.pathList {
-  display: grid;
-  gap: 10px;
-}
-
-.contributorCard,
-.pathItem {
-  display: grid;
-  min-width: 0;
-  color: inherit;
-  background: var(--ifm-color-emphasis-100);
-  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
-  text-decoration: none !important;
-  transition: border-color 0.2s ease, transform 0.2s ease, background 0.2s ease;
-}
-
-.contributorCard:hover,
-.contributorCard:focus-visible,
-.pathItem:hover,
-.pathItem:focus-visible {
-  color: inherit;
-  background: var(--ifm-background-color);
-  border-color: var(--ifm-color-primary);
-  transform: translateY(-1px);
-}
-
-[data-theme='dark'] .contributorCard,
-[data-theme='dark'] .pathItem {
-  background: rgba(255, 255, 255, 0.03);
-  border-color: rgba(255, 255, 255, 0.08);
-}
-
-.contributorCard {
-  grid-template-columns: auto minmax(0, 1fr);
-  gap: 12px;
-  align-items: center;
-  padding: 12px;
-}
-
-.avatar {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 44px;
-  height: 44px;
-  color: #fff;
-  background: #165dff;
-  border-radius: 8px;
-  font-size: 13px;
-  font-weight: 800;
-}
-
-.avatarImage {
-  width: 44px;
-  height: 44px;
-  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
-  object-fit: cover;
-}
-
-.contributorCard:nth-child(2) .avatar {
-  background: #00a870;
-}
-
-.contributorCard:nth-child(3) .avatar {
-  background: #ff7d00;
-}
-
-.contributorBody {
-  display: grid;
-  min-width: 0;
-  gap: 2px;
-}
-
-.contributorBody strong {
-  color: var(--ifm-heading-color);
-  font-size: 0.98rem;
-}
-
-.contributorBody span {
-  color: var(--ifm-color-content);
-  font-size: 0.88rem;
-}
-
-.contributorBody em,
-.pathItem em {
-  color: var(--ifm-color-content-secondary);
-  font-size: 0.82rem;
-  font-style: normal;
-  line-height: 1.45;
-}
-
-.pathItem {
-  grid-template-columns: auto minmax(0, 1fr);
-  gap: 12px;
-  padding: 14px;
-}
-
-.pathIndex {
-  color: var(--ifm-color-primary);
-  font-family: var(--ifm-font-family-monospace);
-  font-size: 0.86rem;
-  font-weight: 800;
-}
-
-.pathItem strong {
-  display: block;
-  margin-bottom: 4px;
-  color: var(--ifm-heading-color);
-  font-size: 0.96rem;
-}
-
-@media (max-width: 996px) {
-  .section {
-    padding: 4rem 0;
-  }
-
-  .sectionTitle {
-    font-size: 2rem;
-  }
-
-  .communityGrid {
-    grid-template-columns: 1fr;
-  }
-
-  .sponsorLogoGrid {
-    grid-template-columns: repeat(3, minmax(0, 1fr));
-  }
-
-  .sponsorLogoTile {
-    min-height: 96px;
-  }
-}
-
-@media (max-width: 640px) {
-  .section {
-    padding: 3.25rem 0;
-  }
-
-  .sectionTitle {
-    font-size: 1.75rem;
-  }
-
-  .sponsorWallHeader {
-    display: grid;
-    min-height: auto;
-    padding: 1rem;
-  }
-
-  .sponsorWallAction {
-    justify-content: center;
-    width: 100%;
-  }
-
-  .sponsorLogoGrid {
-    grid-template-columns: repeat(2, minmax(0, 1fr));
-  }
-
-  .sponsorLogoMark {
-    font-size: 1.15rem;
-  }
-
-  .panel {
-    padding: 1rem;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .sponsorWallAction,
-  .sponsorLogoTile,
-  .contributorCard,
-  .pathItem {
-    transition: none;
-  }
-}
--- a/docs-site/src/components/HomepageFeatures/index.tsx
+++ b/docs-site/src/components/HomepageFeatures/index.tsx
@@ -129,7 +129,7 @@ function Feature({title, description, icon, link}: FeatureItem) {
      {link && (
        <span className={styles.featureLink}>
          <Translate id="feat.learnMore">Learn more</Translate>
-          <span className={styles.featureArrow} aria-hidden="true">-&gt;</span>
+          <span className={styles.featureArrow} aria-hidden="true">→</span>
        </span>
      )}
    </>
--- a/docs-site/src/components/HomepageFeatures/styles.module.css
+++ b/docs-site/src/components/HomepageFeatures/styles.module.css
@@ -1,6 +1,5 @@
 .section {
-  padding: 5.5rem 0 4.25rem;
-  background: var(--ifm-background-color);
+  padding: 6rem 0 4rem;
 }

 .sectionHead {
@@ -10,17 +9,14 @@
 }

 .sectionTag {
-  display: inline-flex;
-  align-items: center;
-  min-height: 28px;
+  display: inline-block;
  font-size: 12px;
-  font-weight: 750;
-  letter-spacing: 0;
+  font-weight: 600;
+  letter-spacing: 0.15em;
  color: var(--ifm-color-primary);
  padding: 4px 12px;
  background: rgba(22, 93, 255, 0.08);
-  border: 1px solid rgba(22, 93, 255, 0.16);
-  border-radius: 8px;
+  border-radius: 4px;
  margin-bottom: 1rem;
 }

@@ -30,10 +26,10 @@
 }

 .sectionTitle {
-  font-size: 2.35rem;
+  font-size: clamp(1.8rem, 3vw, 2.5rem);
  line-height: 1.2;
-  letter-spacing: 0;
-  font-weight: 750;
+  letter-spacing: -0.02em;
+  font-weight: 700;
  margin: 0 0 1rem;
  color: var(--ifm-heading-color);
 }
@@ -55,9 +51,6 @@
  .section {
    padding: 3.5rem 0 2rem;
  }
-  .sectionTitle {
-    font-size: 2rem;
-  }
  .grid {
    grid-template-columns: 1fr;
  }
@@ -77,7 +70,7 @@
  padding: 1.75rem;
  background: var(--ifm-background-color);
  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
+  border-radius: 12px;
  transition: transform 0.2s ease, box-shadow 0.2s ease, border-color 0.2s ease;
  text-decoration: none !important;
  color: inherit;
@@ -85,7 +78,7 @@
 }

 .featureCardLink:hover {
-  transform: translateY(-2px);
+  transform: translateY(-3px);
  border-color: var(--ifm-color-primary);
  box-shadow: 0 12px 30px -8px rgba(22, 93, 255, 0.18);
  color: inherit;
@@ -106,26 +99,26 @@
 .iconWrap {
  width: 48px;
  height: 48px;
-  border-radius: 8px;
+  border-radius: 10px;
  display: flex;
  align-items: center;
  justify-content: center;
-  background: linear-gradient(135deg, rgba(22, 93, 255, 0.1) 0%, rgba(20, 201, 201, 0.12) 100%);
+  background: linear-gradient(135deg, rgba(22, 93, 255, 0.1) 0%, rgba(143, 75, 255, 0.08) 100%);
  color: var(--ifm-color-primary);
  margin-bottom: 1.25rem;
 }

 [data-theme='dark'] .iconWrap {
-  background: linear-gradient(135deg, rgba(96, 126, 255, 0.15) 0%, rgba(20, 201, 201, 0.12) 100%);
+  background: linear-gradient(135deg, rgba(96, 126, 255, 0.15) 0%, rgba(143, 75, 255, 0.12) 100%);
  color: var(--ifm-color-primary-lighter);
 }

 .featureTitle {
  font-size: 1.15rem;
-  font-weight: 700;
+  font-weight: 600;
  margin: 0 0 0.6rem;
  color: var(--ifm-heading-color);
-  letter-spacing: 0;
+  letter-spacing: -0.01em;
 }

 .featureDesc {
@@ -153,17 +146,3 @@
 .featureCardLink:hover .featureArrow {
  transform: translateX(4px);
 }
-
-@media (max-width: 640px) {
-  .sectionTitle {
-    font-size: 1.75rem;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .featureCard,
-  .featureCardLink,
-  .featureArrow {
-    transition: none;
-  }
-}
--- a/docs-site/src/components/HomepageShowcase/index.tsx
+++ b/docs-site/src/components/HomepageShowcase/index.tsx
@@ -110,7 +110,7 @@ export default function HomepageShowcase(): ReactNode {
            <p className={styles.captionDesc}>{current.description}</p>
            <Link to="/docs/getting-started/quick-start" className={styles.captionLink}>
              <Translate id="showcase.cta">Explore the docs</Translate>
-              <span aria-hidden="true"> -&gt;</span>
+              <span aria-hidden="true"> →</span>
            </Link>
          </div>
        </div>
--- a/docs-site/src/components/HomepageShowcase/styles.module.css
+++ b/docs-site/src/components/HomepageShowcase/styles.module.css
@@ -1,14 +1,10 @@
 .section {
-  padding: 4.5rem 0 5.5rem;
-  background:
-    linear-gradient(180deg, rgba(245, 247, 250, 0) 0%, rgba(245, 247, 250, 0.72) 100%),
-    var(--ifm-background-color);
+  padding: 4rem 0 6rem;
+  background: linear-gradient(180deg, transparent 0%, rgba(22, 93, 255, 0.03) 100%);
 }

 [data-theme='dark'] .section {
-  background:
-    linear-gradient(180deg, rgba(15, 17, 21, 0) 0%, rgba(255, 255, 255, 0.03) 100%),
-    var(--ifm-background-color);
+  background: linear-gradient(180deg, transparent 0%, rgba(64, 128, 255, 0.04) 100%);
 }

 .sectionHead {
@@ -18,30 +14,26 @@
 }

 .sectionTag {
-  display: inline-flex;
-  align-items: center;
-  min-height: 28px;
+  display: inline-block;
  font-size: 12px;
-  font-weight: 750;
-  letter-spacing: 0;
-  color: #0e7490;
+  font-weight: 600;
+  letter-spacing: 0.15em;
+  color: #8f4bff;
  padding: 4px 12px;
-  background: rgba(20, 201, 201, 0.1);
-  border: 1px solid rgba(20, 201, 201, 0.2);
-  border-radius: 8px;
+  background: rgba(143, 75, 255, 0.08);
+  border-radius: 4px;
  margin-bottom: 1rem;
 }

 [data-theme='dark'] .sectionTag {
-  background: rgba(20, 201, 201, 0.16);
-  color: #67e8f9;
+  background: rgba(143, 75, 255, 0.18);
 }

 .sectionTitle {
-  font-size: 2.35rem;
+  font-size: clamp(1.8rem, 3vw, 2.5rem);
  line-height: 1.2;
-  letter-spacing: 0;
-  font-weight: 750;
+  letter-spacing: -0.02em;
+  font-weight: 700;
  margin: 0 0 1rem;
  color: var(--ifm-heading-color);
 }
@@ -57,39 +49,34 @@
 .tabs {
  display: flex;
  justify-content: center;
-  gap: 6px;
+  gap: 8px;
  margin-bottom: 2rem;
  flex-wrap: wrap;
-  padding: 6px;
-  background: var(--ifm-color-emphasis-100);
-  border: 1px solid var(--ifm-color-emphasis-200);
-  border-radius: 8px;
 }

 .tabBtn {
-  min-height: 40px;
  padding: 8px 18px;
  background: transparent;
-  border: 1px solid transparent;
-  border-radius: 8px;
+  border: 1px solid var(--ifm-color-emphasis-300);
+  border-radius: 999px;
  color: var(--ifm-color-content-secondary);
  font-size: 14px;
-  font-weight: 650;
+  font-weight: 500;
  cursor: pointer;
-  transition: color 0.2s ease, border-color 0.2s ease, background 0.2s ease, box-shadow 0.2s ease;
+  transition: all 0.2s ease;
 }

 .tabBtn:hover {
  color: var(--ifm-color-primary);
-  background: var(--ifm-background-color);
+  border-color: var(--ifm-color-primary);
 }

 .tabBtnActive,
 .tabBtnActive:hover {
-  background: var(--ifm-background-color);
-  color: var(--ifm-color-primary) !important;
-  border-color: rgba(22, 93, 255, 0.18);
-  box-shadow: 0 6px 16px rgba(22, 93, 255, 0.12);
+  background: linear-gradient(90deg, #165dff 0%, #4080ff 100%);
+  color: #fff !important;
+  border-color: transparent;
+  box-shadow: 0 4px 14px rgba(22, 93, 255, 0.3);
 }

 /* Stage */
@@ -109,10 +96,10 @@

 .browser {
  background: var(--ifm-background-color);
-  border-radius: 8px;
+  border-radius: 12px;
  overflow: hidden;
  box-shadow:
-    0 24px 58px -22px rgba(22, 93, 255, 0.28),
+    0 30px 60px -20px rgba(22, 93, 255, 0.25),
    0 0 0 1px var(--ifm-color-emphasis-200);
 }

@@ -150,7 +137,7 @@
  margin: 0 auto;
  padding: 3px 14px;
  background: var(--ifm-background-color);
-  border-radius: 8px;
+  border-radius: 999px;
  font-size: 12px;
  color: var(--ifm-color-content-secondary);
  font-family: 'SFMono-Regular', Menlo, monospace;
@@ -182,8 +169,8 @@
 .captionTitle {
  font-size: 1.7rem;
  line-height: 1.2;
-  letter-spacing: 0;
-  font-weight: 750;
+  letter-spacing: -0.02em;
+  font-weight: 700;
  margin: 0 0 1rem;
  color: var(--ifm-heading-color);
 }
@@ -199,49 +186,11 @@
  display: inline-flex;
  align-items: center;
  gap: 4px;
-  min-height: 40px;
-  padding: 0 12px;
-  border: 1px solid rgba(22, 93, 255, 0.18);
-  border-radius: 8px;
-  font-weight: 650;
+  font-weight: 500;
  color: var(--ifm-color-primary);
  text-decoration: none !important;
-  transition: border-color 0.2s ease, background 0.2s ease;
 }

 .captionLink:hover {
  color: var(--ifm-color-primary-dark);
-  background: rgba(22, 93, 255, 0.06);
-  border-color: var(--ifm-color-primary);
-}
-
-@media (max-width: 996px) {
-  .sectionTitle {
-    font-size: 2rem;
-  }
-}
-
-@media (max-width: 640px) {
-  .section {
-    padding: 3.25rem 0 4rem;
-  }
-
-  .sectionTitle {
-    font-size: 1.75rem;
-  }
-
-  .tabs {
-    justify-content: stretch;
-  }
-
-  .tabBtn {
-    flex: 1 1 130px;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .tabBtn,
-  .captionLink {
-    transition: none;
-  }
 }
--- a/docs-site/src/css/custom.css
+++ b/docs-site/src/css/custom.css
@@ -16,15 +16,14 @@
  /* Surfaces */
  --ifm-background-color: #ffffff;
  --ifm-background-surface-color: #ffffff;
-  --ifm-color-emphasis-100: #f5f7fa;
-  --ifm-color-emphasis-200: #e5e6eb;
-  --ifm-color-emphasis-300: #c9cdd4;
-  --ifm-color-emphasis-400: #a9aeb8;
+  --ifm-color-emphasis-100: #f7f9fc;
+  --ifm-color-emphasis-200: #eef1f6;
+  --ifm-color-emphasis-300: #dde3ec;

  /* Typography */
  --ifm-font-family-base: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', sans-serif;
  --ifm-font-family-monospace: 'SFMono-Regular', Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New', monospace;
-  --ifm-heading-font-weight: 700;
+  --ifm-heading-font-weight: 600;
  --ifm-code-font-size: 92%;
  --ifm-h1-font-size: 2.25rem;
  --ifm-h2-font-size: 1.75rem;
@@ -34,11 +33,10 @@
  --ifm-color-content: #1d2129;
  --ifm-color-content-secondary: #4e5969;
  --ifm-heading-color: #1d2129;
-  --ifm-global-radius: 8px;

  /* Navbar */
  --ifm-navbar-height: 64px;
-  --ifm-navbar-background-color: rgba(255, 255, 255, 0.9);
+  --ifm-navbar-background-color: rgba(255, 255, 255, 0.82);
  --ifm-navbar-link-color: #4e5969;
  --ifm-navbar-link-hover-color: var(--ifm-color-primary);

@@ -66,16 +64,15 @@

  --ifm-background-color: #0f1115;
  --ifm-background-surface-color: #16181d;
-  --ifm-color-emphasis-100: #1d2129;
-  --ifm-color-emphasis-200: #272e3b;
-  --ifm-color-emphasis-300: #384252;
-  --ifm-color-emphasis-400: #4e5969;
+  --ifm-color-emphasis-100: #1a1d23;
+  --ifm-color-emphasis-200: #23272f;
+  --ifm-color-emphasis-300: #2e343d;

  --ifm-color-content: #e6e9ef;
  --ifm-color-content-secondary: #9aa3b2;
  --ifm-heading-color: #f0f2f5;

-  --ifm-navbar-background-color: rgba(15, 17, 21, 0.9);
+  --ifm-navbar-background-color: rgba(15, 17, 21, 0.82);
  --ifm-navbar-link-color: #c9d1db;

  --ifm-menu-color: #c9d1db;
@@ -100,7 +97,7 @@

 .navbar__title {
  font-weight: 700;
-  letter-spacing: 0;
+  letter-spacing: -0.01em;
 }

 .navbar__link {
@@ -108,26 +105,10 @@
  font-size: 14px;
 }

-.navbar__link,
-.button,
-a {
-  transition: color 0.2s ease, background 0.2s ease, border-color 0.2s ease, box-shadow 0.2s ease;
-}
-
-.button {
-  border-radius: 8px;
-  font-weight: 650;
-}
-
-:focus-visible {
-  outline: 2px solid var(--ifm-color-primary);
-  outline-offset: 2px;
-}
-
 /* Sidebar tweaks */
 .menu__link {
  font-size: 14px;
-  border-radius: 8px;
+  border-radius: 6px;
  padding: 6px 10px;
  line-height: 1.4;
 }
@@ -245,20 +226,9 @@ code {
 }

 ::-webkit-scrollbar-thumb:hover {
-  background: var(--ifm-color-emphasis-400);
+  background: var(--ifm-color-emphasis-400, #adb5bd);
 }

 [data-theme='dark'] ::-webkit-scrollbar-thumb {
  background: rgba(255, 255, 255, 0.15);
 }
-
-@media (prefers-reduced-motion: reduce) {
-  *,
-  *::before,
-  *::after {
-    animation-duration: 0.01ms !important;
-    animation-iteration-count: 1 !important;
-    scroll-behavior: auto !important;
-    transition-duration: 0.01ms !important;
-  }
-}
--- a/docs-site/src/pages/community.tsx
+++ b/docs-site/src/pages/community.tsx
@@ -1,19 +0,0 @@
-import type {ReactNode} from 'react';
-import {translate} from '@docusaurus/Translate';
-import Layout from '@theme/Layout';
-import HomepageCommunity from '@site/src/components/HomepageCommunity';
-
-export default function Community(): ReactNode {
-  return (
-    <Layout
-      title={translate({id: 'community.pageTitle', message: 'Community, sponsors and contributors'})}
-      description={translate({
-        id: 'community.pageDescription',
-        message: 'Sponsor BackupX, meet contributors, and find practical ways to contribute.',
-      })}>
-      <main>
-        <HomepageCommunity />
-      </main>
-    </Layout>
-  );
-}
--- a/docs-site/src/pages/index.module.css
+++ b/docs-site/src/pages/index.module.css
@@ -1,42 +1,48 @@
-/* Hero */
+/* ── Hero ───────────────────────────────────────────── */
 .hero {
  position: relative;
+  padding: 7rem 0 6rem;
  overflow: hidden;
-  padding: 7rem 0 5.5rem;
-  background:
-    linear-gradient(180deg, rgba(22, 93, 255, 0.08) 0%, rgba(255, 255, 255, 0) 72%),
-    linear-gradient(90deg, rgba(20, 201, 201, 0.08) 0%, rgba(250, 173, 20, 0.08) 100%),
-    var(--ifm-background-color);
+  background: var(--bx-hero-bg);
 }

-.hero::before {
+.heroBg {
  position: absolute;
  inset: 0;
-  content: "";
-  pointer-events: none;
-  background-image:
-    linear-gradient(rgba(22, 93, 255, 0.06) 1px, transparent 1px),
-    linear-gradient(90deg, rgba(22, 93, 255, 0.06) 1px, transparent 1px);
-  background-size: 44px 44px;
-  mask-image: linear-gradient(180deg, rgba(0, 0, 0, 0.75), transparent 82%);
+  background:
+    radial-gradient(circle at 15% 20%, rgba(104, 127, 255, 0.18) 0%, transparent 45%),
+    radial-gradient(circle at 85% 70%, rgba(22, 93, 255, 0.15) 0%, transparent 50%),
+    linear-gradient(180deg, #f7f9ff 0%, #ffffff 100%);
+  z-index: 0;
 }

-[data-theme='dark'] .hero {
+[data-theme='dark'] .heroBg {
  background:
-    linear-gradient(180deg, rgba(64, 128, 255, 0.16) 0%, rgba(15, 17, 21, 0) 72%),
-    linear-gradient(90deg, rgba(20, 201, 201, 0.1) 0%, rgba(250, 173, 20, 0.08) 100%),
-    var(--ifm-background-color);
+    radial-gradient(circle at 15% 20%, rgba(96, 126, 255, 0.22) 0%, transparent 45%),
+    radial-gradient(circle at 85% 70%, rgba(118, 70, 255, 0.18) 0%, transparent 50%),
+    linear-gradient(180deg, #0f1115 0%, #0b0d10 100%);
 }

 .heroInner {
  position: relative;
  z-index: 1;
  display: grid;
-  grid-template-columns: minmax(0, 1fr) minmax(420px, 0.9fr);
+  grid-template-columns: 1.1fr 1fr;
  gap: 4rem;
  align-items: center;
 }

+@media (max-width: 996px) {
+  .hero {
+    padding: 4rem 0 3rem;
+  }
+  .heroInner {
+    grid-template-columns: 1fr;
+    gap: 2.5rem;
+    text-align: left;
+  }
+}
+
 .heroContent {
  display: flex;
  flex-direction: column;
@@ -48,144 +54,137 @@
  display: inline-flex;
  align-items: center;
  gap: 8px;
-  min-height: 32px;
-  padding: 5px 12px;
-  color: var(--ifm-color-primary);
-  background: rgba(22, 93, 255, 0.09);
-  border: 1px solid rgba(22, 93, 255, 0.2);
-  border-radius: 8px;
+  padding: 4px 14px;
+  background: rgba(22, 93, 255, 0.08);
+  border: 1px solid rgba(22, 93, 255, 0.15);
+  border-radius: 999px;
  font-size: 13px;
-  font-weight: 600;
+  color: var(--ifm-color-primary);
+  font-weight: 500;
 }

 [data-theme='dark'] .badge {
-  background: rgba(64, 128, 255, 0.16);
-  border-color: rgba(64, 128, 255, 0.3);
+  background: rgba(96, 126, 255, 0.15);
+  border-color: rgba(96, 126, 255, 0.3);
  color: var(--ifm-color-primary-lighter);
 }

 .badgeDot {
-  width: 7px;
-  height: 7px;
-  background: #00b42a;
+  width: 6px;
+  height: 6px;
+  background: var(--ifm-color-primary);
  border-radius: 50%;
-  box-shadow: 0 0 0 4px rgba(0, 180, 42, 0.12);
+  box-shadow: 0 0 0 4px rgba(22, 93, 255, 0.18);
+  animation: pulse 2s infinite;
+}
+
+@keyframes pulse {
+  0%, 100% { opacity: 1; }
+  50% { opacity: 0.5; }
 }

 .heroTitle {
+  font-size: clamp(2.25rem, 4vw, 3.4rem);
+  line-height: 1.15;
+  letter-spacing: -0.025em;
+  font-weight: 700;
  margin: 0;
  color: var(--ifm-heading-color);
-  font-size: 3.45rem;
-  font-weight: 750;
-  letter-spacing: 0;
-  line-height: 1.08;
 }

 .heroTitleAccent {
  display: block;
-  margin-top: 8px;
-  color: var(--ifm-color-primary);
+  background: linear-gradient(90deg, #4080ff 0%, #8f4bff 100%);
+  -webkit-background-clip: text;
+  -webkit-text-fill-color: transparent;
+  background-clip: text;
+  margin-top: 6px;
 }

 .heroSubtitle {
-  max-width: 640px;
-  margin: 0;
-  color: var(--ifm-color-content-secondary);
  font-size: 1.15rem;
-  line-height: 1.72;
+  line-height: 1.65;
+  color: var(--ifm-color-content-secondary);
+  max-width: 540px;
+  margin: 0;
 }

 .actions {
  display: flex;
-  flex-wrap: wrap;
  gap: 12px;
  margin-top: 8px;
-}
-
-.primaryBtn,
-.secondaryBtn {
-  min-height: 46px;
-  border-radius: 8px;
-  transition: transform 0.2s ease, box-shadow 0.2s ease, border-color 0.2s ease, background 0.2s ease;
+  flex-wrap: wrap;
 }

 .primaryBtn {
+  background: linear-gradient(90deg, #165dff 0%, #4080ff 100%);
+  border: none;
+  color: #fff;
  display: inline-flex;
  align-items: center;
-  gap: 8px;
-  color: #fff;
-  background: #165dff;
-  border: 1px solid #165dff;
-  box-shadow: 0 10px 24px rgba(22, 93, 255, 0.24);
-  font-weight: 650;
+  gap: 6px;
+  font-weight: 600;
+  box-shadow: 0 6px 20px rgba(22, 93, 255, 0.3);
+  transition: transform 0.2s ease, box-shadow 0.2s ease;
 }

-.primaryBtn:hover,
-.primaryBtn:focus-visible {
-  color: #fff;
-  background: #0e4fe6;
-  border-color: #0e4fe6;
-  box-shadow: 0 14px 30px rgba(22, 93, 255, 0.3);
+.primaryBtn:hover {
  transform: translateY(-1px);
+  box-shadow: 0 10px 25px rgba(22, 93, 255, 0.4);
+  color: #fff;
 }

 .btnArrow {
  transition: transform 0.2s ease;
 }

-.primaryBtn:hover .btnArrow,
-.primaryBtn:focus-visible .btnArrow {
-  transform: translateX(3px);
+.primaryBtn:hover .btnArrow {
+  transform: translateX(4px);
 }

 .secondaryBtn {
-  display: inline-flex;
-  align-items: center;
-  color: var(--ifm-font-color-base);
  background: var(--ifm-background-color);
  border: 1px solid var(--ifm-color-emphasis-300);
-  font-weight: 600;
+  color: var(--ifm-font-color-base);
+  display: inline-flex;
+  align-items: center;
+  font-weight: 500;
+  transition: all 0.2s ease;
 }

-.secondaryBtn:hover,
-.secondaryBtn:focus-visible {
-  color: var(--ifm-color-primary);
+.secondaryBtn:hover {
  border-color: var(--ifm-color-primary);
+  color: var(--ifm-color-primary);
  background: var(--ifm-background-color);
-  transform: translateY(-1px);
 }

 .metrics {
  display: flex;
  align-items: center;
-  gap: 1.5rem;
+  gap: 1.75rem;
+  padding-top: 1.5rem;
  margin-top: 0.5rem;
-  padding-top: 1.25rem;
 }

 .metric {
  display: flex;
-  min-width: 0;
  flex-direction: column;
-  gap: 4px;
+  gap: 2px;
 }

 .metricValue {
+  font-size: 1.6rem;
+  font-weight: 700;
  color: var(--ifm-heading-color);
-  font-size: 1.35rem;
-  font-weight: 750;
-  letter-spacing: 0;
  line-height: 1.1;
-  white-space: nowrap;
+  letter-spacing: -0.02em;
 }

 .metricLabel {
-  color: var(--ifm-color-content-secondary);
  font-size: 12px;
-  font-weight: 600;
-  letter-spacing: 0;
-  line-height: 1.35;
+  color: var(--ifm-color-content-secondary);
  text-transform: uppercase;
+  letter-spacing: 0.05em;
 }

 .metricDivider {
@@ -194,277 +193,81 @@
  background: var(--ifm-color-emphasis-300);
 }

-/* Product visual */
-.heroVisual {
-  display: grid;
-  gap: 1rem;
+/* ── Code window (macOS-style) ─────────────────────── */
+.heroCode {
+  position: relative;
 }

-.consolePanel {
+.codeWindow {
+  background: #0f1622;
+  border-radius: 12px;
+  box-shadow:
+    0 20px 50px -10px rgba(15, 22, 34, 0.35),
+    0 0 0 1px rgba(255, 255, 255, 0.05);
  overflow: hidden;
-  background: rgba(255, 255, 255, 0.92);
-  border: 1px solid rgba(22, 93, 255, 0.16);
-  border-radius: 8px;
-  box-shadow: 0 24px 60px rgba(29, 33, 41, 0.12);
+  border: 1px solid rgba(255, 255, 255, 0.06);
 }

-[data-theme='dark'] .consolePanel {
-  background: rgba(22, 24, 29, 0.9);
-  border-color: rgba(255, 255, 255, 0.08);
-  box-shadow: 0 24px 60px rgba(0, 0, 0, 0.34);
+[data-theme='light'] .codeWindow {
+  box-shadow: 0 20px 50px -10px rgba(22, 93, 255, 0.2), 0 0 0 1px rgba(22, 93, 255, 0.06);
 }

-.consoleHeader {
+.codeHeader {
  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-  padding: 1.25rem;
-  border-bottom: 1px solid var(--ifm-color-emphasis-200);
-}
-
-[data-theme='dark'] .consoleHeader {
-  border-bottom-color: rgba(255, 255, 255, 0.08);
-}
-
-.consoleHeader strong {
-  display: block;
-  margin-top: 4px;
-  color: var(--ifm-heading-color);
-  font-size: 1.2rem;
-}
-
-.consoleEyebrow {
-  color: var(--ifm-color-content-secondary);
-  font-size: 12px;
-  font-weight: 650;
-  letter-spacing: 0;
-  text-transform: uppercase;
-}
-
-.consoleStatus {
-  display: inline-flex;
  align-items: center;
-  min-height: 28px;
-  padding: 4px 10px;
-  color: #00a870;
-  background: rgba(0, 180, 42, 0.1);
-  border: 1px solid rgba(0, 180, 42, 0.2);
-  border-radius: 8px;
-  font-size: 12px;
-  font-weight: 700;
+  gap: 6px;
+  padding: 10px 14px;
+  background: #161f2e;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.04);
 }

-.consoleGrid {
-  display: grid;
-  grid-template-columns: repeat(3, minmax(0, 1fr));
-  border-bottom: 1px solid var(--ifm-color-emphasis-200);
-}
-
-[data-theme='dark'] .consoleGrid {
-  border-bottom-color: rgba(255, 255, 255, 0.08);
-}
-
-.consoleGrid > div {
-  min-width: 0;
-  padding: 1.1rem 1.25rem;
-  border-right: 1px solid var(--ifm-color-emphasis-200);
-}
-
-[data-theme='dark'] .consoleGrid > div {
-  border-right-color: rgba(255, 255, 255, 0.08);
-}
-
-.consoleGrid > div:last-child {
-  border-right: 0;
-}
-
-.consoleGrid strong {
-  display: block;
-  margin-top: 6px;
-  color: var(--ifm-heading-color);
-  font-size: 1.45rem;
-  line-height: 1.1;
-}
-
-.consoleLabel {
-  display: block;
-  color: var(--ifm-color-content-secondary);
-  font-size: 12px;
-  font-weight: 650;
-}
-
-.timeline {
-  display: grid;
-}
-
-.timelineRow {
-  display: grid;
-  grid-template-columns: auto minmax(0, 1fr) auto;
-  gap: 12px;
-  align-items: center;
-  padding: 1rem 1.25rem;
-  border-bottom: 1px solid var(--ifm-color-emphasis-200);
-}
-
-[data-theme='dark'] .timelineRow {
-  border-bottom-color: rgba(255, 255, 255, 0.08);
-}
-
-.timelineRow:last-child {
-  border-bottom: 0;
-}
-
-.timelineRow strong,
-.timelineRow span {
-  display: block;
-}
-
-.timelineRow strong {
-  color: var(--ifm-heading-color);
-  font-size: 0.95rem;
-  font-weight: 700;
-}
-
-.timelineRow span {
-  color: var(--ifm-color-content-secondary);
-  font-size: 0.85rem;
-  line-height: 1.5;
-}
-
-.timelineRow em {
-  color: var(--ifm-color-content-secondary);
-  font-size: 0.8rem;
-  font-style: normal;
-  font-weight: 650;
-  white-space: nowrap;
-}
-
-.timelineDotOk,
-.timelineDotInfo,
-.timelineDotWarn {
-  width: 10px;
-  height: 10px;
+.codeDot {
+  width: 11px;
+  height: 11px;
  border-radius: 50%;
 }

-.timelineDotOk {
-  background: #00b42a;
-}
+.codeDotRed { background: #ff5f56; }
+.codeDotYellow { background: #ffbd2e; }
+.codeDotGreen { background: #27c93f; }

-.timelineDotInfo {
-  background: #165dff;
-}
-
-.timelineDotWarn {
-  background: #ff7d00;
-}
-
-.commandCard {
-  display: grid;
-  gap: 8px;
-  padding: 1rem 1.1rem;
-  background: #111827;
-  border: 1px solid rgba(255, 255, 255, 0.08);
-  border-radius: 8px;
-  box-shadow: 0 16px 34px rgba(17, 24, 39, 0.18);
-}
-
-.commandTitle {
-  color: #9ca3af;
-  font-size: 12px;
-  font-weight: 650;
-  letter-spacing: 0;
+.codeTitle {
+  margin-left: auto;
+  font-size: 11px;
+  color: #7b8696;
+  letter-spacing: 0.05em;
  text-transform: uppercase;
 }

-.commandCard code {
-  overflow-x: auto;
-  color: #e5e7eb;
-  background: transparent;
-  border: 0;
-  padding: 0;
+.codeBody {
+  margin: 0;
+  padding: 18px 20px;
+  font-family: 'SFMono-Regular', Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New', monospace;
  font-size: 13px;
-  white-space: nowrap;
+  line-height: 1.65;
+  color: #e1e7ef;
+  background: transparent;
+  overflow-x: auto;
 }

-@media (max-width: 996px) {
-  .hero {
-    padding: 4.5rem 0 3.5rem;
-  }
-
-  .heroInner {
-    grid-template-columns: 1fr;
-    gap: 2.25rem;
-  }
-
-  .heroTitle {
-    font-size: 2.45rem;
-  }
+.codeBody code {
+  background: transparent;
+  padding: 0;
+  border: 0;
+  color: inherit;
 }

-@media (max-width: 640px) {
-  .hero {
-    padding: 3.75rem 0 2.75rem;
-  }
-
-  .heroTitle {
-    font-size: 2.05rem;
-  }
-
-  .heroSubtitle {
-    font-size: 1rem;
-  }
-
-  .actions {
-    width: 100%;
-  }
-
-  .primaryBtn,
-  .secondaryBtn {
-    width: 100%;
-    justify-content: center;
-  }
-
-  .metrics {
-    width: 100%;
-    align-items: stretch;
-    gap: 0.85rem;
-    flex-direction: column;
-  }
-
-  .metricDivider {
-    width: 100%;
-    height: 1px;
-  }
-
-  .consoleHeader,
-  .timelineRow {
-    padding: 1rem;
-  }
-
-  .consoleGrid {
-    grid-template-columns: 1fr;
-  }
-
-  .consoleGrid > div {
-    border-right: 0;
-    border-bottom: 1px solid var(--ifm-color-emphasis-200);
-  }
-
-  .consoleGrid > div:last-child {
-    border-bottom: 0;
-  }
-
-  [data-theme='dark'] .consoleGrid > div {
-    border-bottom-color: rgba(255, 255, 255, 0.08);
-  }
+.codePrompt {
+  color: #4080ff;
+  margin-right: 6px;
+  user-select: none;
 }

-@media (prefers-reduced-motion: reduce) {
-  .primaryBtn,
-  .secondaryBtn,
-  .btnArrow {
-    transition: none;
-  }
+.codeComment {
+  color: #6e7889;
+  font-style: italic;
+}
+
+.codeString {
+  color: #82d1ff;
 }
--- a/docs-site/src/pages/index.tsx
+++ b/docs-site/src/pages/index.tsx
@@ -7,34 +7,34 @@ import Layout from '@theme/Layout';
 import Heading from '@theme/Heading';
 import HomepageFeatures from '@site/src/components/HomepageFeatures';
 import HomepageShowcase from '@site/src/components/HomepageShowcase';
-import HomepageCommunity from '@site/src/components/HomepageCommunity';

 import styles from './index.module.css';

 function HomepageHeader() {
  return (
    <header className={styles.hero}>
+      <div className={styles.heroBg} aria-hidden="true" />
      <div className={clsx('container', styles.heroInner)}>
        <div className={styles.heroContent}>
          <div className={styles.badge}>
            <span className={styles.badgeDot} />
-            <Translate id="home.badge">Open-source backup control plane · v2.2.1</Translate>
+            <Translate id="home.badge">Open-source · v1.6.0</Translate>
          </div>
          <Heading as="h1" className={styles.heroTitle}>
-            <Translate id="home.title.part1">Backup orchestration</Translate>
+            <Translate id="home.title.part1">Self-hosted backup management</Translate>
            <span className={styles.heroTitleAccent}>
-              <Translate id="home.title.part2">for self-hosted servers.</Translate>
+              <Translate id="home.title.part2">for every server.</Translate>
            </span>
          </Heading>
          <p className={styles.heroSubtitle}>
            <Translate id="home.tagline">
-              Run file, database, SAP HANA and remote-node backups from one clean console. Keep the control plane yours, keep the storage flexible.
+              One binary, one command. File / database / SAP HANA backups routed to 70+ storage backends.
            </Translate>
          </p>
          <div className={styles.actions}>
            <Link className={clsx('button button--primary button--lg', styles.primaryBtn)} to="/docs/getting-started/quick-start">
              <Translate id="home.getStarted">Get Started</Translate>
-              <span className={styles.btnArrow} aria-hidden="true">-&gt;</span>
+              <span className={styles.btnArrow} aria-hidden="true">→</span>
            </Link>
            <Link className={clsx('button button--lg', styles.secondaryBtn)} to="https://github.com/Awuqing/BackupX">
              <svg width="18" height="18" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true" style={{marginRight: 6}}>
@@ -52,9 +52,9 @@ function HomepageHeader() {
            </div>
            <div className={styles.metricDivider} />
            <div className={styles.metric}>
-              <div className={styles.metricValue}>Agent</div>
+              <div className={styles.metricValue}>5</div>
              <div className={styles.metricLabel}>
-                <Translate id="home.metric.backupTypes">Remote execution</Translate>
+                <Translate id="home.metric.backupTypes">Backup types</Translate>
              </div>
            </div>
            <div className={styles.metricDivider} />
@@ -66,85 +66,29 @@ function HomepageHeader() {
            </div>
          </div>
        </div>
-        <div className={styles.heroVisual}>
-          <div className={styles.consolePanel}>
-            <div className={styles.consoleHeader}>
-              <div>
-                <span className={styles.consoleEyebrow}>
-                  <Translate id="home.visual.eyebrow">BackupX Console</Translate>
-                </span>
-                <strong>
-                  <Translate id="home.visual.title">Operations overview</Translate>
-                </strong>
-              </div>
-              <span className={styles.consoleStatus}>
-                <Translate id="home.visual.status">Healthy</Translate>
-              </span>
+        <div className={styles.heroCode}>
+          <div className={styles.codeWindow}>
+            <div className={styles.codeHeader}>
+              <span className={clsx(styles.codeDot, styles.codeDotRed)} />
+              <span className={clsx(styles.codeDot, styles.codeDotYellow)} />
+              <span className={clsx(styles.codeDot, styles.codeDotGreen)} />
+              <span className={styles.codeTitle}>bash</span>
            </div>
-            <div className={styles.consoleGrid}>
-              <div>
-                <span className={styles.consoleLabel}>
-                  <Translate id="home.visual.success">Success rate</Translate>
-                </span>
-                <strong>99.4%</strong>
-              </div>
-              <div>
-                <span className={styles.consoleLabel}>
-                  <Translate id="home.visual.nodes">Active nodes</Translate>
-                </span>
-                <strong>12</strong>
-              </div>
-              <div>
-                <span className={styles.consoleLabel}>
-                  <Translate id="home.visual.targets">Storage targets</Translate>
-                </span>
-                <strong>8</strong>
-              </div>
-            </div>
-            <div className={styles.timeline}>
-              <div className={styles.timelineRow}>
-                <span className={styles.timelineDotOk} />
-                <div>
-                  <strong>
-                    <Translate id="home.visual.row1.title">PostgreSQL nightly</Translate>
-                  </strong>
-                  <span>
-                    <Translate id="home.visual.row1.desc">Encrypted archive uploaded to S3</Translate>
-                  </span>
-                </div>
-                <em>02:10</em>
-              </div>
-              <div className={styles.timelineRow}>
-                <span className={styles.timelineDotInfo} />
-                <div>
-                  <strong>
-                    <Translate id="home.visual.row2.title">SAP HANA snapshot</Translate>
-                  </strong>
-                  <span>
-                    <Translate id="home.visual.row2.desc">Running on agent-shanghai-02</Translate>
-                  </span>
-                </div>
-                <em>68%</em>
-              </div>
-              <div className={styles.timelineRow}>
-                <span className={styles.timelineDotWarn} />
-                <div>
-                  <strong>
-                    <Translate id="home.visual.row3.title">Retention cleanup</Translate>
-                  </strong>
-                  <span>
-                    <Translate id="home.visual.row3.desc">Next run in 4 hours</Translate>
-                  </span>
-                </div>
-                <em>queued</em>
-              </div>
-            </div>
-          </div>
-          <div className={styles.commandCard}>
-            <div className={styles.commandTitle}>
-              <Translate id="home.command.title">Start with Docker</Translate>
-            </div>
-            <code>docker run -d -p 8340:8340 awuqing/backupx:v2.2.1</code>
+            <pre className={styles.codeBody}>
+              <code>
+                <span className={styles.codeComment}># Docker one-liner</span>{'\n'}
+                <span className={styles.codePrompt}>$</span> docker run -d --name backupx \{'\n'}
+                {'    '}-p 8340:8340 \{'\n'}
+                {'    '}-v backupx-data:/app/data \{'\n'}
+                {'    '}awuqing/backupx:latest{'\n'}
+                {'\n'}
+                <span className={styles.codeComment}># Open http://localhost:8340</span>{'\n'}
+                <span className={styles.codeComment}># Deploy an Agent on a remote host</span>{'\n'}
+                <span className={styles.codePrompt}>$</span> backupx agent \{'\n'}
+                {'    '}--master <span className={styles.codeString}>http://master:8340</span> \{'\n'}
+                {'    '}--token <span className={styles.codeString}>&lt;token&gt;</span>
+              </code>
+            </pre>
          </div>
        </div>
      </div>
@@ -156,13 +100,12 @@ export default function Home(): ReactNode {
  const {siteConfig} = useDocusaurusContext();
  return (
    <Layout
-      title={translate({id: 'home.pageTitle', message: 'Backup orchestration for self-hosted servers'})}
+      title={translate({id: 'home.pageTitle', message: 'Self-hosted backup management'})}
      description={siteConfig.tagline}>
      <HomepageHeader />
      <main>
        <HomepageFeatures />
        <HomepageShowcase />
-        <HomepageCommunity />
      </main>
    </Layout>
  );
--- a/docs-site/src/pages/sponsors.tsx
+++ b/docs-site/src/pages/sponsors.tsx
@@ -1,39 +0,0 @@
-import type {ReactNode} from 'react';
-import {translate} from '@docusaurus/Translate';
-import Translate from '@docusaurus/Translate';
-import Layout from '@theme/Layout';
-import Heading from '@theme/Heading';
-import {HomepageSponsors} from '@site/src/components/HomepageCommunity';
-import styles from '@site/src/components/HomepageCommunity/styles.module.css';
-
-export default function Sponsors(): ReactNode {
-  return (
-    <Layout
-      title={translate({id: 'sponsors.pageTitle', message: 'Sponsors'})}
-      description={translate({
-        id: 'sponsors.pageDescription',
-        message: 'Sponsor BackupX reliability, documentation, storage compatibility and long-term maintenance.',
-      })}>
-      <main>
-        <section className={styles.section}>
-          <div className="container">
-            <div className={styles.sectionHead}>
-              <div className={styles.sectionTag}>
-                <Translate id="sponsors.tag">SPONSORS</Translate>
-              </div>
-              <Heading as="h1" className={styles.sectionTitle}>
-                <Translate id="sponsors.title">Sponsor the BackupX ecosystem</Translate>
-              </Heading>
-              <p className={styles.sectionSubtitle}>
-                <Translate id="sponsors.subtitle">
-                  Sponsorship helps keep BackupX practical for real operators: tested storage providers, reliable releases, restore confidence and better documentation.
-                </Translate>
-              </p>
-            </div>
-            <HomepageSponsors />
-          </div>
-        </section>
-      </main>
-    </Layout>
-  );
-}
--- a/server/config.example.yaml
+++ b/server/config.example.yaml
@@ -3,9 +3,6 @@ server:
  host: "0.0.0.0"
  port: 8340
  mode: "release"              # debug | release
-  external_url: ""             # 可选：Master 对 Agent 可达的 URL，例如 https://backup.example.com
-  web_root: ""                 # 前端静态目录；留空自动探测（./web、/opt/backupx/web 等）。
-                               # 命中后后端直接托管 Web 控制台，无需额外 nginx 反向代理。

 database:
  path: "./data/backupx.db"    # SQLite 数据库路径
--- a/server/go.mod
+++ b/server/go.mod
@@ -6,15 +6,12 @@ require (
 	github.com/gin-gonic/gin v1.10.1
 	github.com/glebarez/sqlite v1.11.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
-	github.com/klauspost/compress v1.18.1
 	github.com/natefinch/lumberjack v2.0.0+incompatible
-	github.com/pquerna/otp v1.5.0
-	github.com/prometheus/client_golang v1.23.2
-	github.com/rclone/rclone v1.73.5
+	github.com/rclone/rclone v1.73.3
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/spf13/viper v1.20.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.50.0
+	golang.org/x/crypto v0.48.0
 	golang.org/x/oauth2 v0.34.0
 	google.golang.org/api v0.255.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -30,10 +27,10 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 // indirect
-	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
 	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/FilenCloudDienste/filen-sdk-go v0.0.38 // indirect
+	github.com/FilenCloudDienste/filen-sdk-go v0.0.37 // indirect
 	github.com/Files-com/files-sdk-go/v3 v3.2.264 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.18.5 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
@@ -50,26 +47,25 @@ require (
 	github.com/anchore/go-lzo v0.1.0 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.8 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.3 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.31.17 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.11 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 // indirect
-	github.com/aws/smithy-go v1.25.1 // indirect
+	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
@@ -111,7 +107,7 @@ require (
 	github.com/glebarez/go-sqlite v1.21.2 // indirect
 	github.com/go-chi/chi/v5 v5.2.5 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -150,6 +146,7 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/jtolio/noiseconn v0.0.0-20231127013910-f6d9ecbf1de7 // indirect
 	github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004 // indirect
+	github.com/klauspost/compress v1.18.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988 // indirect
 	github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 // indirect
@@ -183,6 +180,8 @@ require (
 	github.com/pkg/xattr v0.4.12 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/pquerna/otp v1.5.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.2 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
@@ -225,22 +224,22 @@ require (
 	go.mongodb.org/mongo-driver v1.17.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.41.0 // indirect
-	go.opentelemetry.io/otel/metric v1.41.0 // indirect
-	go.opentelemetry.io/otel/trace v1.41.0 // indirect
+	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel/metric v1.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.39.0 // indirect
 	go.uber.org/multierr v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/arch v0.14.0 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/image v0.41.0 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/term v0.42.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
+	golang.org/x/image v0.32.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	google.golang.org/grpc v1.79.3 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
--- a/server/go.sum
+++ b/server/go.sum
@@ -51,8 +51,8 @@ github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3 h1:ZJJNFaQ86GVKQ9ehw
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3/go.mod h1:URuDvhmATVKqHBH9/0nOiNKk0+YcwfQ3WkK5PqHKxc8=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3 h1:sxgSqOB9CDToiaVFpxuvb5wGgGqWa3lCShcm5o0n3bE=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.5.3/go.mod h1:XdED8i399lEVblYHTZM8eXaP07gv4Z58IL6ueMlVlrg=
-github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
-github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26 h1:gy/jrlpp8EfSyA73a51fofoSfhp5rPNQAUvDr4Dm91c=
+github.com/Azure/go-ntlmssp v0.0.2-0.20251110135918-10b7b7e7cd26/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
@@ -61,8 +61,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/FilenCloudDienste/filen-sdk-go v0.0.38 h1:YCyHs3wUXEe2BEWn40vcoyaQ2ruHNmNwkasfo3Th16A=
-github.com/FilenCloudDienste/filen-sdk-go v0.0.38/go.mod h1:0cBhKXQg49XbKZZfk5TCDa3sVLP+xMxZTWL+7KY0XR0=
+github.com/FilenCloudDienste/filen-sdk-go v0.0.37 h1:W8S9TrAyZ4//3PXsU6+Bi+fe/6uIL986GyS7PVzIDL4=
+github.com/FilenCloudDienste/filen-sdk-go v0.0.37/go.mod h1:0cBhKXQg49XbKZZfk5TCDa3sVLP+xMxZTWL+7KY0XR0=
 github.com/Files-com/files-sdk-go/v3 v3.2.264 h1:lMHTplAYI9FtmCo/QOcpRxmPA5REVAct1r2riQmDQKw=
 github.com/Files-com/files-sdk-go/v3 v3.2.264/go.mod h1:wGqkOzRu/ClJibvDgcfuJNAqI2nLhe8g91tPlDKRCdE=
 github.com/IBM/go-sdk-core/v5 v5.18.5 h1:g0JRl3sYXJczB/yuDlrN6x22LJ6jIxhp0Sa4ARNW60c=
@@ -102,46 +102,44 @@ github.com/andybalholm/cascadia v1.3.3 h1:AG2YHrzJIm4BZ19iwJ/DAua6Btl3IwJX+VI4kk
 github.com/andybalholm/cascadia v1.3.3/go.mod h1:xNd9bqTn98Ln4DwST8/nG+H0yuB8Hmgu1YHNnWw0GeA=
 github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc h1:LoL75er+LKDHDUfU5tRvFwxH0LjPpZN8OoG8Ll+liGU=
 github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc/go.mod h1:w648aMHEgFYS6xb0KVMMtZ2uMeemhiKCuD2vj6gY52A=
-github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
-github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
-github.com/aws/aws-sdk-go-v2/config v1.32.8 h1:iu+64gwDKEoKnyTQskSku72dAwggKI5sV6rNvgSMpMs=
-github.com/aws/aws-sdk-go-v2/config v1.32.8/go.mod h1:MI2XvA+qDi3i9AJxX1E2fu730syEBzp/jnXrjxuHwgI=
+github.com/aws/aws-sdk-go-v2 v1.41.3 h1:4kQ/fa22KjDt13QCy1+bYADvdgcxpfH18f0zP542kZA=
+github.com/aws/aws-sdk-go-v2 v1.41.3/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6 h1:N4lRUXZpZ1KVEUn6hxtco/1d2lgYhNn1fHkkl8WhlyQ=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.6/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/config v1.31.17 h1:QFl8lL6RgakNK86vusim14P2k8BFSxjvUkcWLDjgz9Y=
+github.com/aws/aws-sdk-go-v2/config v1.31.17/go.mod h1:V8P7ILjp/Uef/aX8TjGk6OHZN6IKPM5YW6S78QnRD5c=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.11 h1:NdV8cwCcAXrCWyxArt58BrvZJ9pZ9Fhf9w6Uh5W3Uyc=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.11/go.mod h1:30yY2zqkMPdrvxBqzI9xQCM+WrlrZKSOpSJEsylVU+8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 h1:INUvJxmhdEbVulJYHI061k4TVuS3jzzthNvjqvVvTKM=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19/go.mod h1:FpZN2QISLdEBWkayloda+sZjVJL+e9Gl0k1SyTgcswU=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.1 h1:IbWiN670htmBioc+Zj32vSpJgQ2+OYSlvTvfQ1nCORQ=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.1/go.mod h1:tw/B596EUhBWDFGdDGuLC21fVU4A3s4/5Efy8S39W18=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4 h1:2fjfz3/G9BRvIKuNZ655GwzpklC2kEH0cowZQGO7uBg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.4/go.mod h1:Ymws824lvMypLFPwyyUXM52SXuGgxpu0+DISLfKvB+c=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 h1:/sECfyq2JTifMI2JPyZ4bdRN77zJmr6SrS1eL3augIA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19/go.mod h1:dMf8A5oAqr9/oxOfLkC/c2LU/uMcALP0Rgn2BD5LWn0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 h1:AWeJMk33GTBf6J20XJe6qZoRSJo0WfUhsMdUKhoODXE=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19/go.mod h1:+GWrYoaAsV7/4pNHpwh1kiNLXkKaSoppxQq9lbH8Ejw=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 h1:Y2cAXlClHsXkkOvWZFXATr34b0hxxloeQu/pAZz2row=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.7/go.mod h1:idzZ7gmDeqeNrSPkdbtMp9qWMgcBwykA7P7Rzh5DXVU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20 h1:qi3e/dmpdONhj1RyIZdi6DKKpDXS5Lb8ftr3p7cyHJc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.20/go.mod h1:V1K+TeJVD5JOk3D9e5tsX2KUdL7BlB+FV6cBhdobN8c=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 h1:XAq62tBTJP/85lFD5oqOOe7YYgWxY9LvWq8plyDvDVg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11 h1:BYf7XNsJMzl4mObARUBUib+j2tf0U//JAAtTnYqvqCw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.11/go.mod h1:aEUS4WrNk/+FxkBZZa7tVgp4pGH+kFGW40Y8rCPqt5g=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 h1:X1Tow7suZk9UCJHE1Iw9GMZJJl0dAnKXXP1NaSDHwmw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19/go.mod h1:/rARO8psX+4sfjUQXp5LLifjUt8DuATZ31WptNJTyQA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19 h1:JnQeStZvPHFHeyky/7LbMlyQjUa+jIBj36OlWm0pzIk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.19/go.mod h1:HGyasyHvYdFQeJhvDHfH7HXkHh57htcJGKDZ+7z+I24=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4 h1:4ExZyubQ6LQQVuF2Qp9OsfEvsTdAWh5Gfwf6PgIdLdk=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.4/go.mod h1:NF3JcMGOiARAss1ld3WGORCw71+4ExDD2cbbdKS5PpA=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 h1:iSsvB9EtQ09YrsmIc44Heqlx5ByGErqhPK1ZQLppias=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.12/go.mod h1:fEWYKTRGoZNl8tZ77i61/ccwOMJdGxwOhWCkp6TXAr0=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 h1:EnUdUqRP1CNzt2DkV67tJx6XDN4xlfBFm+bzeNOQVb0=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16/go.mod h1:Jic/xv0Rq/pFNCh3WwpH4BEqdbSAl+IyHro8LbibHD8=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 h1:XQTQTF75vnug2TXS8m7CVJfC2nniYPZnO1D4Np761Oo=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.8/go.mod h1:Xgx+PR1NUOjNmQY+tRMnouRp83JRM8pRMw/vCaVhPkI=
-github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
-github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -258,8 +256,8 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 h1:JnrjqG5iR07/8k7NqrLNilRsl3s1EPRQEGvbPyOce68=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348/go.mod h1:Czxo/d1g948LtrALAZdL04TL/HnkopquAjxYUuI02bo=
-github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
-github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
+github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -532,8 +530,8 @@ github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11 h1:4MI2
 github.com/rclone/Proton-API-Bridge v1.0.1-0.20260127174007-77f974840d11/go.mod h1:3HLX7dwZgvB7nt+Yl/xdzVPcargQ1yBmJEUg3n+jMKM=
 github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18 h1:Lc+d3ISfQaMJKWZOE7z4ZSY4RVmdzbn1B0IM8xN18qM=
 github.com/rclone/go-proton-api v1.0.1-0.20260127173028-eb465cac3b18/go.mod h1:LB2kCEaZMzNn3ocdz+qYfxXmuLxxN0ka62KJd2x53Bc=
-github.com/rclone/rclone v1.73.5 h1:r8a9JHYIWUqk7hNRJuMJ3cROkKfB2zmfkADg8ZLYh6I=
-github.com/rclone/rclone v1.73.5/go.mod h1:WVv8gvA/lEl/Y37e8I8yosm7ZY+Szq7ujXbJS8Ol63o=
+github.com/rclone/rclone v1.73.3 h1:XKlobcnXxxzxnB6UBSVtRB+UeZmYDV9B4QExVSSGoAY=
+github.com/rclone/rclone v1.73.3/go.mod h1:QJDWatpAY9sKGXfpKZUXbThvtHoeo78DcFP2+/cbkvc=
 github.com/relvacode/iso8601 v1.7.0 h1:BXy+V60stMP6cpswc+a93Mq3e65PfXCgDFfhvNNGrdo=
 github.com/relvacode/iso8601 v1.7.0/go.mod h1:FlNp+jz+TXpyRqgmM7tnzHHzBnz776kmAH2h3sZCn0I=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
@@ -653,16 +651,16 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
-go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
-go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
-go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
-go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
 go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
 go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
 go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
 go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
-go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
@@ -690,8 +688,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -702,12 +700,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
+golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
-golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/image v0.32.0 h1:6lZQWq75h7L5IWNk0r+SCpUJ6tUVd3v4ZHnbRKLkUDQ=
+golang.org/x/image v0.32.0/go.mod h1:/R37rrQmKXtO6tYXAjtDLwQgFLHmhW+V6ayXlxzP2Pc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -732,8 +730,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -773,8 +771,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -798,8 +796,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -849,8 +847,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -862,8 +860,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -879,8 +877,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -933,8 +931,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
--- a/server/internal/agent/agent.go
+++ b/server/internal/agent/agent.go
@@ -11,8 +11,6 @@ import (
 	"strings"
 	"sync"
 	"time"
-
-	"backupx/server/internal/backup"
 )

 // Agent 是 Agent 进程的主控制器。
@@ -133,12 +131,6 @@ func (a *Agent) pollAndHandleOnce(ctx context.Context) {
 		a.handleRunTask(ctx, cmd)
 	case "list_dir":
 		a.handleListDir(ctx, cmd)
-	case "restore_record":
-		a.handleRestoreRecord(ctx, cmd)
-	case "discover_db":
-		a.handleDiscoverDB(ctx, cmd)
-	case "delete_storage_object":
-		a.handleDeleteStorageObject(ctx, cmd)
 	default:
 		msg := fmt.Sprintf("unknown command type: %s", cmd.Type)
 		log.Printf("[agent] %s", msg)
@@ -166,83 +158,6 @@ func (a *Agent) handleRunTask(ctx context.Context, cmd *CommandPayload) {
 	})
 }

-// handleRestoreRecord 处理 restore_record 命令
-func (a *Agent) handleRestoreRecord(ctx context.Context, cmd *CommandPayload) {
-	var payload struct {
-		RestoreRecordID uint `json:"restoreRecordId"`
-	}
-	if err := json.Unmarshal(cmd.Payload, &payload); err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "invalid payload: "+err.Error(), nil)
-		return
-	}
-	if payload.RestoreRecordID == 0 {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "restoreRecordId is required", nil)
-		return
-	}
-	if err := a.executor.ExecuteRestore(ctx, payload.RestoreRecordID); err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, err.Error(), nil)
-		return
-	}
-	_ = a.client.SubmitCommandResult(ctx, cmd.ID, true, "", map[string]any{
-		"restoreRecordId": payload.RestoreRecordID,
-	})
-}
-
-// handleDeleteStorageObject 处理 delete_storage_object 命令：在 Agent 侧删除指定存储对象。
-// 用于跨节点 local_disk 场景下的远程备份文件清理。
-func (a *Agent) handleDeleteStorageObject(ctx context.Context, cmd *CommandPayload) {
-	var payload struct {
-		TargetType   string         `json:"targetType"`
-		TargetConfig map[string]any `json:"targetConfig"`
-		StoragePath  string         `json:"storagePath"`
-	}
-	if err := json.Unmarshal(cmd.Payload, &payload); err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "invalid payload: "+err.Error(), nil)
-		return
-	}
-	if strings.TrimSpace(payload.StoragePath) == "" {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "storagePath is required", nil)
-		return
-	}
-	provider, err := a.executor.storageRegistry.Create(ctx, payload.TargetType, payload.TargetConfig)
-	if err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "create provider: "+err.Error(), nil)
-		return
-	}
-	if err := provider.Delete(ctx, payload.StoragePath); err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "delete object: "+err.Error(), nil)
-		return
-	}
-	_ = a.client.SubmitCommandResult(ctx, cmd.ID, true, "", map[string]any{"deleted": true})
-}
-
-// handleDiscoverDB 处理 discover_db 命令：在 Agent 本机执行 mysql/psql 列出数据库。
-func (a *Agent) handleDiscoverDB(ctx context.Context, cmd *CommandPayload) {
-	var payload struct {
-		Type     string `json:"type"`
-		Host     string `json:"host"`
-		Port     int    `json:"port"`
-		User     string `json:"user"`
-		Password string `json:"password"`
-	}
-	if err := json.Unmarshal(cmd.Payload, &payload); err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, "invalid payload: "+err.Error(), nil)
-		return
-	}
-	databases, err := backup.DiscoverDatabases(ctx, backup.NewOSCommandExecutor(), backup.DiscoverRequest{
-		Type:     payload.Type,
-		Host:     payload.Host,
-		Port:     payload.Port,
-		User:     payload.User,
-		Password: payload.Password,
-	})
-	if err != nil {
-		_ = a.client.SubmitCommandResult(ctx, cmd.ID, false, err.Error(), nil)
-		return
-	}
-	_ = a.client.SubmitCommandResult(ctx, cmd.ID, true, "", map[string]any{"databases": databases})
-}
-
 // handleListDir 处理 list_dir 命令（阶段四实现）
 func (a *Agent) handleListDir(ctx context.Context, cmd *CommandPayload) {
 	var payload struct {
--- a/server/internal/agent/client.go
+++ b/server/internal/agent/client.go
@@ -143,24 +143,13 @@ func (c *MasterClient) GetTaskSpec(ctx context.Context, taskID uint) (*TaskSpec,

 // RecordUpdate 与 service.AgentRecordUpdate 对齐
 type RecordUpdate struct {
-	Status               string              `json:"status,omitempty"`
-	FileName             string              `json:"fileName,omitempty"`
-	FileSize             int64               `json:"fileSize,omitempty"`
-	Checksum             string              `json:"checksum,omitempty"`
-	StoragePath          string              `json:"storagePath,omitempty"`
-	StorageTargetID      uint                `json:"storageTargetId,omitempty"`
-	StorageUploadResults []StorageResultItem `json:"storageUploadResults,omitempty"`
-	ErrorMessage         string              `json:"errorMessage,omitempty"`
-	LogAppend            string              `json:"logAppend,omitempty"`
-}
-
-type StorageResultItem struct {
-	StorageTargetID   uint   `json:"storageTargetId"`
-	StorageTargetName string `json:"storageTargetName"`
-	Status            string `json:"status"`
-	StoragePath       string `json:"storagePath,omitempty"`
-	FileSize          int64  `json:"fileSize,omitempty"`
-	Error             string `json:"error,omitempty"`
+	Status       string `json:"status,omitempty"`
+	FileName     string `json:"fileName,omitempty"`
+	FileSize     int64  `json:"fileSize,omitempty"`
+	Checksum     string `json:"checksum,omitempty"`
+	StoragePath  string `json:"storagePath,omitempty"`
+	ErrorMessage string `json:"errorMessage,omitempty"`
+	LogAppend    string `json:"logAppend,omitempty"`
 }

 // UpdateRecord 上报备份记录的状态/日志
@@ -169,53 +158,6 @@ func (c *MasterClient) UpdateRecord(ctx context.Context, recordID uint, update R
 	return c.do(ctx, http.MethodPost, path, update, nil)
 }

-// RestoreSpec 与 service.AgentRestoreSpec 对齐
-type RestoreSpec struct {
-	RestoreRecordID uint                `json:"restoreRecordId"`
-	BackupRecordID  uint                `json:"backupRecordId"`
-	TaskID          uint                `json:"taskId"`
-	TaskName        string              `json:"taskName"`
-	Type            string              `json:"type"`
-	SourcePath      string              `json:"sourcePath,omitempty"`
-	SourcePaths     []string            `json:"sourcePaths,omitempty"`
-	DBHost          string              `json:"dbHost,omitempty"`
-	DBPort          int                 `json:"dbPort,omitempty"`
-	DBUser          string              `json:"dbUser,omitempty"`
-	DBPassword      string              `json:"dbPassword,omitempty"`
-	DBName          string              `json:"dbName,omitempty"`
-	DBPath          string              `json:"dbPath,omitempty"`
-	ExtraConfig     string              `json:"extraConfig,omitempty"`
-	Compression     string              `json:"compression"`
-	Encrypt         bool                `json:"encrypt"`
-	Storage         StorageTargetConfig `json:"storage"`
-	StoragePath     string              `json:"storagePath"`
-	FileName        string              `json:"fileName"`
-	Checksum        string              `json:"checksum,omitempty"`
-}
-
-// RestoreUpdate 与 service.AgentRestoreUpdate 对齐
-type RestoreUpdate struct {
-	Status       string `json:"status,omitempty"`
-	ErrorMessage string `json:"errorMessage,omitempty"`
-	LogAppend    string `json:"logAppend,omitempty"`
-}
-
-// GetRestoreSpec 拉取恢复规格
-func (c *MasterClient) GetRestoreSpec(ctx context.Context, restoreRecordID uint) (*RestoreSpec, error) {
-	var spec RestoreSpec
-	path := fmt.Sprintf("/api/agent/restores/%d/spec", restoreRecordID)
-	if err := c.do(ctx, http.MethodGet, path, nil, &spec); err != nil {
-		return nil, err
-	}
-	return &spec, nil
-}
-
-// UpdateRestore 上报恢复记录的状态/日志
-func (c *MasterClient) UpdateRestore(ctx context.Context, restoreRecordID uint, update RestoreUpdate) error {
-	path := fmt.Sprintf("/api/agent/restores/%d", restoreRecordID)
-	return c.do(ctx, http.MethodPost, path, update, nil)
-}
-
 // do 是通用 HTTP 调用。所有 Agent API 都统一走 JSON + X-Agent-Token。
 func (c *MasterClient) do(ctx context.Context, method, path string, body any, out any) error {
 	var reqBody io.Reader
--- a/server/internal/agent/config.go
+++ b/server/internal/agent/config.go
@@ -26,7 +26,7 @@ type Config struct {
 	HeartbeatInterval string `yaml:"heartbeatInterval"`
 	// PollInterval 命令轮询间隔，默认 5s
 	PollInterval string `yaml:"pollInterval"`
-	// TempDir 备份临时目录，默认 /var/lib/backupx-agent/tmp
+	// TempDir 备份临时目录，默认 /tmp/backupx-agent
 	TempDir string `yaml:"tempDir"`
 	// InsecureSkipTLSVerify 测试环境允许跳过 TLS 证书校验
 	InsecureSkipTLSVerify bool `yaml:"insecureSkipTlsVerify"`
@@ -98,7 +98,7 @@ func applyConfigDefaults(cfg *Config) (*Config, error) {
 		cfg.PollInterval = "5s"
 	}
 	if cfg.TempDir == "" {
-		cfg.TempDir = "/var/lib/backupx-agent/tmp"
+		cfg.TempDir = "/tmp/backupx-agent"
 	}
 	cfg.Master = strings.TrimRight(strings.TrimSpace(cfg.Master), "/")
 	return cfg, nil
--- a/server/internal/agent/config_test.go
+++ b/server/internal/agent/config_test.go
@@ -50,7 +50,7 @@ func TestLoadConfigDefaults(t *testing.T) {
 	if cfg.HeartbeatInterval != "15s" || cfg.PollInterval != "5s" {
 		t.Errorf("default intervals not applied: %+v", cfg)
 	}
-	if cfg.TempDir != "/var/lib/backupx-agent/tmp" {
+	if cfg.TempDir != "/tmp/backupx-agent" {
 		t.Errorf("default tempdir: %q", cfg.TempDir)
 	}
 }
--- a/server/internal/agent/executor.go
+++ b/server/internal/agent/executor.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
-	"encoding/json"
 	"fmt"
 	"io"
 	"os"
@@ -20,10 +19,10 @@ import (

 // Executor 负责在 Agent 本地执行命令。
 type Executor struct {
-	client          *MasterClient
-	tempDir         string
-	backupRegistry  *backup.Registry
-	storageRegistry *storage.Registry
+	client           *MasterClient
+	tempDir          string
+	backupRegistry   *backup.Registry
+	storageRegistry  *storage.Registry
 }

 // NewExecutor 构造执行器。预先初始化 backup runner 与 storage registry。
@@ -34,7 +33,6 @@ func NewExecutor(client *MasterClient, tempDir string) *Executor {
 		backup.NewMySQLRunner(nil),
 		backup.NewPostgreSQLRunner(nil),
 		backup.NewSAPHANARunner(nil),
-		backup.NewMongoDBRunner(nil),
 	)
 	storageRegistry := storage.NewRegistry(
 		storageRclone.NewLocalDiskFactory(),
@@ -61,11 +59,6 @@ func NewExecutor(client *MasterClient, tempDir string) *Executor {
 // 注意：Agent 当前不支持 Encrypt=true（加密密钥不下发到 Agent，避免密钥扩散）。
 // 遇到启用加密的任务会向 Master 上报失败并返回错误。
 func (e *Executor) ExecuteRunTask(ctx context.Context, taskID, recordID uint) error {
-	if err := e.ensureTempDir(); err != nil {
-		e.reportRecordFailure(ctx, recordID, err.Error())
-		return err
-	}
-
 	// 1) 拉取任务规格
 	spec, err := e.client.GetTaskSpec(ctx, taskID)
 	if err != nil {
@@ -81,6 +74,10 @@ func (e *Executor) ExecuteRunTask(ctx context.Context, taskID, recordID uint) er

 	// 2) 构造 backup.TaskSpec 并找对应 runner
 	startedAt := time.Now().UTC()
+	if err := os.MkdirAll(e.tempDir, 0o755); err != nil {
+		e.reportRecordFailure(ctx, recordID, fmt.Sprintf("创建临时目录失败: %v", err))
+		return err
+	}
 	backupSpec := buildBackupTaskSpec(spec, startedAt, e.tempDir)
 	runner, err := e.backupRegistry.Runner(backupSpec.Type)
 	if err != nil {
@@ -107,14 +104,6 @@ func (e *Executor) ExecuteRunTask(ctx context.Context, taskID, recordID uint) er
 			return compressErr
 		}
 		finalPath = compressedPath
-	} else if strings.EqualFold(spec.Compression, "zstd") && !strings.HasSuffix(strings.ToLower(finalPath), ".zst") {
-		e.appendLog(ctx, recordID, "[agent] 开始压缩备份文件（zstd）\n")
-		compressedPath, compressErr := compress.ZstdFile(finalPath)
-		if compressErr != nil {
-			e.reportRecordFailure(ctx, recordID, fmt.Sprintf("压缩失败: %v", compressErr))
-			return compressErr
-		}
-		finalPath = compressedPath
 	}
 	info, err := os.Stat(finalPath)
 	if err != nil {
@@ -135,52 +124,22 @@ func (e *Executor) ExecuteRunTask(ctx context.Context, taskID, recordID uint) er
 		e.reportRecordFailure(ctx, recordID, "没有关联的存储目标")
 		return fmt.Errorf("no storage targets")
 	}
-	uploadResults := make([]StorageResultItem, 0, len(spec.StorageTargets))
-	selectedStorageTargetID := uint(0)
-	var uploadErrors []string
 	for _, target := range spec.StorageTargets {
 		if err := e.uploadToTarget(ctx, recordID, target, finalPath, storagePath, fileSize, spec.TaskID); err != nil {
-			uploadResults = append(uploadResults, StorageResultItem{
-				StorageTargetID:   target.ID,
-				StorageTargetName: target.Name,
-				Status:            "failed",
-				Error:             err.Error(),
-			})
-			uploadErrors = append(uploadErrors, fmt.Sprintf("%s: %v", target.Name, err))
-			e.appendLog(ctx, recordID, fmt.Sprintf("[agent] 上传到存储目标 %s 失败: %v\n", target.Name, err))
-			continue
+			e.reportRecordFailure(ctx, recordID, fmt.Sprintf("上传到 %s 失败: %v", target.Name, err))
+			return err
 		}
-		if selectedStorageTargetID == 0 {
-			selectedStorageTargetID = target.ID
-		}
-		uploadResults = append(uploadResults, StorageResultItem{
-			StorageTargetID:   target.ID,
-			StorageTargetName: target.Name,
-			Status:            "success",
-			StoragePath:       storagePath,
-			FileSize:          fileSize,
-		})
 		e.appendLog(ctx, recordID, fmt.Sprintf("[agent] 已上传到存储目标 %s\n", target.Name))
 	}
-	if selectedStorageTargetID == 0 {
-		msg := strings.Join(uploadErrors, "; ")
-		if msg == "" {
-			msg = "所有存储目标上传均失败"
-		}
-		e.reportRecordFailureWithUploadResults(ctx, recordID, msg, uploadResults)
-		return fmt.Errorf("%s", msg)
-	}

 	// 6) 上报最终成功
 	return e.client.UpdateRecord(ctx, recordID, RecordUpdate{
-		Status:               "success",
-		FileName:             fileName,
-		FileSize:             fileSize,
-		Checksum:             checksum,
-		StoragePath:          storagePath,
-		StorageTargetID:      selectedStorageTargetID,
-		StorageUploadResults: uploadResults,
-		LogAppend:            fmt.Sprintf("[agent] 任务完成，总计 %d 字节\n", fileSize),
+		Status:      "success",
+		FileName:    fileName,
+		FileSize:    fileSize,
+		Checksum:    checksum,
+		StoragePath: storagePath,
+		LogAppend:   fmt.Sprintf("[agent] 任务完成，总计 %d 字节\n", fileSize),
 	})
 }

@@ -216,22 +175,31 @@ func (e *Executor) appendLog(ctx context.Context, recordID uint, line string) {

 // reportRecordFailure 上报失败状态
 func (e *Executor) reportRecordFailure(ctx context.Context, recordID uint, msg string) {
-	e.reportRecordFailureWithUploadResults(ctx, recordID, msg, nil)
-}
-
-func (e *Executor) reportRecordFailureWithUploadResults(ctx context.Context, recordID uint, msg string, uploadResults []StorageResultItem) {
 	_ = e.client.UpdateRecord(ctx, recordID, RecordUpdate{
-		Status:               "failed",
-		ErrorMessage:         msg,
-		StorageUploadResults: uploadResults,
-		LogAppend:            fmt.Sprintf("[agent] 错误: %s\n", msg),
+		Status:       "failed",
+		ErrorMessage: msg,
+		LogAppend:    fmt.Sprintf("[agent] 错误: %s\n", msg),
 	})
 }

 // buildBackupTaskSpec 把 AgentTaskSpec 转换为 backup.TaskSpec。
 func buildBackupTaskSpec(spec *TaskSpec, startedAt time.Time, tempDir string) backup.TaskSpec {
-	sourcePaths := parseStringListField(spec.SourcePaths)
-	excludes := parseStringListField(spec.ExcludePatterns)
+	var sourcePaths []string
+	if strings.TrimSpace(spec.SourcePaths) != "" {
+		for _, p := range strings.Split(spec.SourcePaths, "\n") {
+			if p = strings.TrimSpace(p); p != "" {
+				sourcePaths = append(sourcePaths, p)
+			}
+		}
+	}
+	var excludes []string
+	if strings.TrimSpace(spec.ExcludePatterns) != "" {
+		for _, p := range strings.Split(spec.ExcludePatterns, "\n") {
+			if p = strings.TrimSpace(p); p != "" {
+				excludes = append(excludes, p)
+			}
+		}
+	}
 	return backup.TaskSpec{
 		ID:              spec.TaskID,
 		Name:            spec.Name,
@@ -254,37 +222,6 @@ func buildBackupTaskSpec(spec *TaskSpec, startedAt time.Time, tempDir string) ba
 	}
 }

-func (e *Executor) ensureTempDir() error {
-	if err := os.MkdirAll(e.tempDir, 0o755); err != nil {
-		return fmt.Errorf("create agent temp dir: %w", err)
-	}
-	return nil
-}
-
-func parseStringListField(value string) []string {
-	trimmed := strings.TrimSpace(value)
-	if trimmed == "" || trimmed == "[]" {
-		return nil
-	}
-	var jsonItems []string
-	if err := json.Unmarshal([]byte(trimmed), &jsonItems); err == nil {
-		return compactStringList(jsonItems)
-	}
-	return compactStringList(strings.FieldsFunc(trimmed, func(r rune) bool {
-		return r == '\n' || r == '\r'
-	}))
-}
-
-func compactStringList(items []string) []string {
-	result := make([]string, 0, len(items))
-	for _, item := range items {
-		if trimmed := strings.TrimSpace(item); trimmed != "" {
-			result = append(result, trimmed)
-		}
-	}
-	return result
-}
-
 // recordLogger 把 runner 日志回传到 Master 记录。
 // 实现 backup.LogWriter，每条日志追加到 record.log_content。
 type recordLogger struct {
@@ -301,208 +238,6 @@ func (l *recordLogger) WriteLine(message string) {
 	_ = l.client.UpdateRecord(l.ctx, l.recordID, RecordUpdate{LogAppend: message + "\n"})
 }

-// restoreLogger 把 runner 日志回传到 Master 恢复记录。
-type restoreLogger struct {
-	ctx       context.Context
-	client    *MasterClient
-	restoreID uint
-}
-
-func newRestoreLogger(ctx context.Context, client *MasterClient, restoreID uint) *restoreLogger {
-	return &restoreLogger{ctx: ctx, client: client, restoreID: restoreID}
-}
-
-func (l *restoreLogger) WriteLine(message string) {
-	_ = l.client.UpdateRestore(l.ctx, l.restoreID, RestoreUpdate{LogAppend: message + "\n"})
-}
-
-// DeleteStorageObject 在 Agent 本机上删除指定存储对象（供跨节点清理调用）。
-func (e *Executor) DeleteStorageObject(ctx context.Context, targetType string, targetConfig map[string]any, storagePath string) error {
-	provider, err := e.storageRegistry.Create(ctx, targetType, targetConfig)
-	if err != nil {
-		return fmt.Errorf("create provider: %w", err)
-	}
-	return provider.Delete(ctx, storagePath)
-}
-
-// ExecuteRestore 处理 restore_record 命令：拉规格 → 下载 → 解压 → 执行 runner.Restore → 上报结果。
-//
-// 与 ExecuteRunTask 对称，但方向相反：
-//   - 下载：通过 spec.Storage 创建 provider → Download(spec.StoragePath)
-//   - 解密：当前 Agent 不支持加密恢复（密钥未下发），spec.Encrypt=true 会直接失败
-//   - 执行：backup.Registry.Runner(spec.Type).Restore
-//   - 上报：通过 UpdateRestore（status/logAppend）
-func (e *Executor) ExecuteRestore(ctx context.Context, restoreRecordID uint) error {
-	if err := e.ensureTempDir(); err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, err.Error())
-		return err
-	}
-
-	spec, err := e.client.GetRestoreSpec(ctx, restoreRecordID)
-	if err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("拉取恢复规格失败: %v", err))
-		return err
-	}
-	if spec.Encrypt {
-		msg := "Agent 不支持加密恢复（加密密钥仅在 Master 端持有）"
-		e.reportRestoreFailure(ctx, restoreRecordID, msg)
-		return fmt.Errorf("%s", msg)
-	}
-	e.appendRestoreLog(ctx, restoreRecordID, fmt.Sprintf("[agent] 开始恢复 %s (type=%s)\n", spec.TaskName, spec.Type))
-
-	tmpDir, err := os.MkdirTemp(e.tempDir, "restore-*")
-	if err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("创建恢复临时目录失败: %v", err))
-		return err
-	}
-	defer os.RemoveAll(tmpDir)
-
-	// 1) 创建 storage provider
-	var rawConfig map[string]any
-	if len(spec.Storage.Config) > 0 {
-		if err := jsonUnmarshalMap(spec.Storage.Config, &rawConfig); err != nil {
-			e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("解析存储配置失败: %v", err))
-			return err
-		}
-	}
-	provider, err := e.storageRegistry.Create(ctx, spec.Storage.Type, rawConfig)
-	if err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("创建存储客户端失败: %v", err))
-		return err
-	}
-
-	// 2) 下载
-	fileName := spec.FileName
-	if strings.TrimSpace(fileName) == "" {
-		fileName = filepath.Base(spec.StoragePath)
-	}
-	artifactPath := filepath.Join(tmpDir, filepath.Base(fileName))
-	e.appendRestoreLog(ctx, restoreRecordID, fmt.Sprintf("[agent] 下载备份文件 %s\n", spec.StoragePath))
-	reader, err := provider.Download(ctx, spec.StoragePath)
-	if err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("下载备份失败: %v", err))
-		return err
-	}
-	if err := writeReaderToLocal(artifactPath, reader); err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("写入备份文件失败: %v", err))
-		return err
-	}
-
-	// 2.5) 完整性校验：还原前比对下载对象的 SHA-256（与 Master 本地恢复路径一致）。
-	// 拒绝还原损坏或被篡改的备份；早期无 checksum 的备份跳过（向后兼容）。
-	if strings.TrimSpace(spec.Checksum) != "" {
-		e.appendRestoreLog(ctx, restoreRecordID, "[agent] 校验备份完整性（SHA-256）\n")
-		actual, sumErr := computeFileSHA256(artifactPath)
-		if sumErr != nil {
-			msg := fmt.Sprintf("计算校验和失败: %v", sumErr)
-			e.reportRestoreFailure(ctx, restoreRecordID, msg)
-			return fmt.Errorf("%s", msg)
-		}
-		if !strings.EqualFold(actual, spec.Checksum) {
-			msg := "备份文件完整性校验失败：SHA-256 不匹配，文件可能已损坏或被篡改"
-			e.reportRestoreFailure(ctx, restoreRecordID, msg)
-			return fmt.Errorf("%s（期望 %s，实际 %s）", msg, spec.Checksum, actual)
-		}
-		e.appendRestoreLog(ctx, restoreRecordID, "[agent] 完整性校验通过\n")
-	}
-
-	// 3) 解压（Agent 不支持加密，遇到 .enc 会直接失败）
-	preparedPath := artifactPath
-	if strings.HasSuffix(strings.ToLower(preparedPath), ".enc") {
-		msg := "检测到加密后缀，Agent 不支持加密恢复"
-		e.reportRestoreFailure(ctx, restoreRecordID, msg)
-		return fmt.Errorf("%s", msg)
-	}
-	if strings.HasSuffix(strings.ToLower(preparedPath), ".gz") {
-		e.appendRestoreLog(ctx, restoreRecordID, "[agent] 解压 gzip 压缩\n")
-		decompressed, err := compress.GunzipFile(preparedPath)
-		if err != nil {
-			e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("解压失败: %v", err))
-			return err
-		}
-		preparedPath = decompressed
-	}
-	if strings.HasSuffix(strings.ToLower(preparedPath), ".zst") {
-		e.appendRestoreLog(ctx, restoreRecordID, "[agent] 解压 zstd 压缩\n")
-		decompressed, err := compress.UnzstdFile(preparedPath)
-		if err != nil {
-			e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("解压失败: %v", err))
-			return err
-		}
-		preparedPath = decompressed
-	}
-
-	// 4) 运行 runner.Restore
-	taskSpec := buildRestoreBackupTaskSpec(spec, time.Now().UTC(), tmpDir)
-	runner, err := e.backupRegistry.Runner(taskSpec.Type)
-	if err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, fmt.Sprintf("不支持的备份类型: %v", err))
-		return err
-	}
-	logger := newRestoreLogger(ctx, e.client, restoreRecordID)
-	if err := runner.Restore(ctx, taskSpec, preparedPath, logger); err != nil {
-		e.reportRestoreFailure(ctx, restoreRecordID, err.Error())
-		return err
-	}
-
-	// 5) 上报成功
-	return e.client.UpdateRestore(ctx, restoreRecordID, RestoreUpdate{
-		Status:    "success",
-		LogAppend: "[agent] 恢复执行完成\n",
-	})
-}
-
-func (e *Executor) appendRestoreLog(ctx context.Context, restoreID uint, line string) {
-	_ = e.client.UpdateRestore(ctx, restoreID, RestoreUpdate{LogAppend: line})
-}
-
-func (e *Executor) reportRestoreFailure(ctx context.Context, restoreID uint, msg string) {
-	_ = e.client.UpdateRestore(ctx, restoreID, RestoreUpdate{
-		Status:       "failed",
-		ErrorMessage: msg,
-		LogAppend:    fmt.Sprintf("[agent] 错误: %s\n", msg),
-	})
-}
-
-// buildRestoreBackupTaskSpec 把 RestoreSpec 转成 backup.TaskSpec。
-func buildRestoreBackupTaskSpec(spec *RestoreSpec, startedAt time.Time, tempDir string) backup.TaskSpec {
-	return backup.TaskSpec{
-		ID:              spec.TaskID,
-		Name:            spec.TaskName,
-		Type:            spec.Type,
-		SourcePath:      spec.SourcePath,
-		SourcePaths:     spec.SourcePaths,
-		ExcludePatterns: nil,
-		Database: backup.DatabaseSpec{
-			Host:     spec.DBHost,
-			Port:     spec.DBPort,
-			User:     spec.DBUser,
-			Password: spec.DBPassword,
-			Path:     spec.DBPath,
-			Names:    splitCommaOrNewline(spec.DBName),
-		},
-		Compression: spec.Compression,
-		Encrypt:     spec.Encrypt,
-		StartedAt:   startedAt,
-		TempDir:     tempDir,
-	}
-}
-
-// writeReaderToLocal 把 reader 写到本地文件（Agent 侧工具函数）。
-func writeReaderToLocal(targetPath string, reader io.ReadCloser) error {
-	defer reader.Close()
-	if err := os.MkdirAll(filepath.Dir(targetPath), 0o755); err != nil {
-		return err
-	}
-	file, err := os.Create(targetPath)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-	_, err = io.Copy(file, reader)
-	return err
-}
-
 // 辅助函数

 func computeFileSHA256(path string) (string, error) {
--- a/server/internal/agent/executor_test.go
+++ b/server/internal/agent/executor_test.go
@@ -1,233 +0,0 @@
-package agent
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"backupx/server/internal/storage"
-)
-
-func TestBuildBackupTaskSpecParsesJSONSourcePaths(t *testing.T) {
-	spec := &TaskSpec{
-		TaskID:          7,
-		Name:            "root-files",
-		Type:            "file",
-		SourcePaths:     `["/root","/etc"]`,
-		ExcludePatterns: `["*.log","tmp"]`,
-	}
-
-	got := buildBackupTaskSpec(spec, time.Unix(0, 0), "/var/lib/backupx-agent/tmp")
-
-	if !reflect.DeepEqual(got.SourcePaths, []string{"/root", "/etc"}) {
-		t.Fatalf("source paths = %#v", got.SourcePaths)
-	}
-	if !reflect.DeepEqual(got.ExcludePatterns, []string{"*.log", "tmp"}) {
-		t.Fatalf("exclude patterns = %#v", got.ExcludePatterns)
-	}
-}
-
-func TestParseStringListFieldKeepsLegacyLineFormat(t *testing.T) {
-	got := parseStringListField("/root\n /etc \n")
-	want := []string{"/root", "/etc"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("paths = %#v, want %#v", got, want)
-	}
-}
-
-func TestExecuteRunTaskRecordsPerTargetUploadResults(t *testing.T) {
-	sourceDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(sourceDir, "index.html"), []byte("hello"), 0o644); err != nil {
-		t.Fatalf("WriteFile returned error: %v", err)
-	}
-	var finalUpdate RecordUpdate
-	var updates []RecordUpdate
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.Method == http.MethodGet && r.URL.Path == "/api/agent/tasks/1":
-			writeAgentEnvelope(t, w, TaskSpec{
-				TaskID:      1,
-				Name:        "site",
-				Type:        "file",
-				SourcePath:  sourceDir,
-				Compression: "gzip",
-				StorageTargets: []StorageTargetConfig{
-					{ID: 11, Name: "broken", Type: "agent_test_storage", Config: json.RawMessage(`{"name":"broken"}`)},
-					{ID: 12, Name: "ok", Type: "agent_test_storage", Config: json.RawMessage(`{"name":"ok"}`)},
-				},
-			})
-		case r.Method == http.MethodPost && r.URL.Path == "/api/agent/records/99":
-			var update RecordUpdate
-			if err := json.NewDecoder(r.Body).Decode(&update); err != nil {
-				t.Fatalf("Decode update returned error: %v", err)
-			}
-			updates = append(updates, update)
-			if update.Status != "" {
-				finalUpdate = update
-			}
-			writeAgentEnvelope(t, w, map[string]string{"status": "ok"})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer server.Close()
-
-	executor := NewExecutor(NewMasterClient(server.URL, "token", false), filepath.Join(t.TempDir(), "tmp"))
-	executor.storageRegistry = storage.NewRegistry(&agentTestStorageFactory{
-		providers: map[string]*agentTestStorageProvider{
-			"broken": {name: "broken", failUpload: true},
-			"ok":     {name: "ok", objects: map[string][]byte{}},
-		},
-	})
-
-	if err := executor.ExecuteRunTask(context.Background(), 1, 99); err != nil {
-		t.Fatalf("ExecuteRunTask returned error: %v", err)
-	}
-	if len(updates) == 0 || finalUpdate.Status != "success" {
-		t.Fatalf("expected final success update, got updates=%#v final=%#v", updates, finalUpdate)
-	}
-	if finalUpdate.StorageTargetID != 12 {
-		t.Fatalf("expected first successful target 12, got %d", finalUpdate.StorageTargetID)
-	}
-	if len(finalUpdate.StorageUploadResults) != 2 {
-		t.Fatalf("expected two upload results, got %#v", finalUpdate.StorageUploadResults)
-	}
-	if finalUpdate.StorageUploadResults[0].Status != "failed" || finalUpdate.StorageUploadResults[1].Status != "success" {
-		t.Fatalf("unexpected upload results: %#v", finalUpdate.StorageUploadResults)
-	}
-	if finalUpdate.StoragePath == "" || finalUpdate.FileSize <= 0 || finalUpdate.Checksum == "" {
-		t.Fatalf("expected artifact metadata in final update, got %#v", finalUpdate)
-	}
-}
-
-func TestExecuteRunTaskReportsPerTargetUploadResultsWhenAllTargetsFail(t *testing.T) {
-	sourceDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(sourceDir, "index.html"), []byte("hello"), 0o644); err != nil {
-		t.Fatalf("WriteFile returned error: %v", err)
-	}
-	var finalUpdate RecordUpdate
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.Method == http.MethodGet && r.URL.Path == "/api/agent/tasks/1":
-			writeAgentEnvelope(t, w, TaskSpec{
-				TaskID:      1,
-				Name:        "site",
-				Type:        "file",
-				SourcePath:  sourceDir,
-				Compression: "gzip",
-				StorageTargets: []StorageTargetConfig{
-					{ID: 11, Name: "broken-a", Type: "agent_test_storage", Config: json.RawMessage(`{"name":"broken-a"}`)},
-					{ID: 12, Name: "broken-b", Type: "agent_test_storage", Config: json.RawMessage(`{"name":"broken-b"}`)},
-				},
-			})
-		case r.Method == http.MethodPost && r.URL.Path == "/api/agent/records/99":
-			var update RecordUpdate
-			if err := json.NewDecoder(r.Body).Decode(&update); err != nil {
-				t.Fatalf("Decode update returned error: %v", err)
-			}
-			if update.Status != "" {
-				finalUpdate = update
-			}
-			writeAgentEnvelope(t, w, map[string]string{"status": "ok"})
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer server.Close()
-
-	executor := NewExecutor(NewMasterClient(server.URL, "token", false), filepath.Join(t.TempDir(), "tmp"))
-	executor.storageRegistry = storage.NewRegistry(&agentTestStorageFactory{
-		providers: map[string]*agentTestStorageProvider{
-			"broken-a": {name: "broken-a", failUpload: true},
-			"broken-b": {name: "broken-b", failUpload: true},
-		},
-	})
-
-	if err := executor.ExecuteRunTask(context.Background(), 1, 99); err == nil {
-		t.Fatal("expected ExecuteRunTask to return upload failure")
-	}
-	if finalUpdate.Status != "failed" {
-		t.Fatalf("expected final failed update, got %#v", finalUpdate)
-	}
-	if len(finalUpdate.StorageUploadResults) != 2 {
-		t.Fatalf("expected failed update to keep per-target results, got %#v", finalUpdate.StorageUploadResults)
-	}
-	for _, item := range finalUpdate.StorageUploadResults {
-		if item.Status != "failed" || item.Error == "" {
-			t.Fatalf("unexpected upload result: %#v", item)
-		}
-	}
-}
-
-type agentTestStorageFactory struct {
-	providers map[string]*agentTestStorageProvider
-}
-
-func (f *agentTestStorageFactory) Type() storage.ProviderType {
-	return "agent_test_storage"
-}
-
-func (f *agentTestStorageFactory) New(_ context.Context, config map[string]any) (storage.StorageProvider, error) {
-	name, _ := config["name"].(string)
-	provider := f.providers[name]
-	if provider == nil {
-		return nil, fmt.Errorf("unknown provider %q", name)
-	}
-	return provider, nil
-}
-
-type agentTestStorageProvider struct {
-	name       string
-	failUpload bool
-	objects    map[string][]byte
-}
-
-func (p *agentTestStorageProvider) Type() storage.ProviderType { return "agent_test_storage" }
-func (p *agentTestStorageProvider) TestConnection(context.Context) error {
-	return nil
-}
-func (p *agentTestStorageProvider) Upload(_ context.Context, objectKey string, reader io.Reader, _ int64, _ map[string]string) error {
-	if p.failUpload {
-		return fmt.Errorf("upload failed for %s", p.name)
-	}
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	if p.objects == nil {
-		p.objects = map[string][]byte{}
-	}
-	p.objects[objectKey] = data
-	return nil
-}
-func (p *agentTestStorageProvider) Download(_ context.Context, objectKey string) (io.ReadCloser, error) {
-	data, ok := p.objects[objectKey]
-	if !ok {
-		return nil, fmt.Errorf("object %s not found", objectKey)
-	}
-	return io.NopCloser(strings.NewReader(string(data))), nil
-}
-func (p *agentTestStorageProvider) Delete(_ context.Context, objectKey string) error {
-	delete(p.objects, objectKey)
-	return nil
-}
-func (p *agentTestStorageProvider) List(context.Context, string) ([]storage.ObjectInfo, error) {
-	return nil, nil
-}
-
-func writeAgentEnvelope(t *testing.T, w http.ResponseWriter, data any) {
-	t.Helper()
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(map[string]any{"code": "OK", "data": data}); err != nil {
-		t.Fatalf("Encode response returned error: %v", err)
-	}
-}
--- a/server/internal/agent/fs.go
+++ b/server/internal/agent/fs.go
@@ -5,7 +5,6 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
-	"strings"
 )

 // DirEntry Agent 返回给 Master 的目录项。
@@ -18,8 +17,8 @@ type DirEntry struct {

 // listLocalDir 列出 Agent 所在机器的指定路径。
 func listLocalDir(path string) ([]DirEntry, error) {
-	cleaned := filepath.Clean(strings.TrimSpace(path))
-	if strings.TrimSpace(path) == "" || cleaned == "." {
+	cleaned := filepath.Clean(path)
+	if cleaned == "" {
 		cleaned = "/"
 	}
 	entries, err := os.ReadDir(cleaned)
--- a/server/internal/agent/fs_test.go
+++ b/server/internal/agent/fs_test.go
@@ -36,21 +36,6 @@ func TestListLocalDir(t *testing.T) {
 	}
 }

-func TestListLocalDirEmptyPathUsesRoot(t *testing.T) {
-	entries, err := listLocalDir("")
-	if err != nil {
-		t.Fatalf("list root: %v", err)
-	}
-	if len(entries) == 0 {
-		t.Fatalf("expected root entries")
-	}
-	for _, entry := range entries {
-		if !filepath.IsAbs(entry.Path) {
-			t.Fatalf("entry path should be absolute: %+v", entry)
-		}
-	}
-}
-
 func TestSplitCommaOrNewline(t *testing.T) {
 	cases := []struct {
 		in  string
--- a/server/internal/app/app.go
+++ b/server/internal/app/app.go
@@ -13,7 +13,6 @@ import (
 	"backupx/server/internal/database"
 	aphttp "backupx/server/internal/http"
 	"backupx/server/internal/logger"
-	"backupx/server/internal/metrics"
 	"backupx/server/internal/notify"
 	"backupx/server/internal/repository"
 	"backupx/server/internal/scheduler"
@@ -60,9 +59,9 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,

 	jwtManager := security.NewJWTManager(resolvedSecurity.JWTSecret, config.MustJWTDuration(cfg.Security))
 	rateLimiter := security.NewLoginRateLimiter(5, time.Minute)
-	configCipher := codec.NewConfigCipher(resolvedSecurity.EncryptionKey)
-	authService := service.NewAuthService(userRepo, systemConfigRepo, jwtManager, rateLimiter, configCipher)
+	authService := service.NewAuthService(userRepo, systemConfigRepo, jwtManager, rateLimiter)
 	systemService := service.NewSystemService(cfg, version, time.Now().UTC())
+	configCipher := codec.NewConfigCipher(resolvedSecurity.EncryptionKey)
 	storageRegistry := storage.NewRegistry(
 		storageRclone.NewLocalDiskFactory(),
 		storageRclone.NewS3Factory(),
@@ -81,13 +80,11 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,
 	storageTargetService.SetBackupRecordRepository(backupRecordRepo)
 	backupTaskService := service.NewBackupTaskService(backupTaskRepo, storageTargetRepo, configCipher)
 	backupTaskService.SetRecordsAndStorage(backupRecordRepo, storageRegistry)
-	// nodeRepo 在下方 Cluster 节点管理区块才实例化，这里延后注入
-	backupRunnerRegistry := backup.NewRegistry(backup.NewFileRunner(), backup.NewSQLiteRunner(), backup.NewMySQLRunner(nil), backup.NewPostgreSQLRunner(nil), backup.NewSAPHANARunner(nil), backup.NewMongoDBRunner(nil))
+	backupRunnerRegistry := backup.NewRegistry(backup.NewFileRunner(), backup.NewSQLiteRunner(), backup.NewMySQLRunner(nil), backup.NewPostgreSQLRunner(nil), backup.NewSAPHANARunner(nil))
 	logHub := backup.NewLogHub()
 	retentionService := backupretention.NewService(backupRecordRepo)
 	notifyRegistry := notify.NewRegistry(notify.NewEmailNotifier(), notify.NewWebhookNotifier(), notify.NewTelegramNotifier())
 	notificationService := service.NewNotificationService(notificationRepo, notifyRegistry, configCipher)
-	authService.SetNotificationService(notificationService)
 	// 初始化 rclone 传输配置（重试 + 带宽限制）
 	rcloneCtx := storageRclone.ConfiguredContext(ctx, storageRclone.TransferConfig{
 		LowLevelRetries: cfg.Backup.Retries,
@@ -100,11 +97,7 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,
 	backupTaskService.SetScheduler(schedulerService)
 	// 审计日志注入延迟到 auditService 创建后（见下方）
 	backupRecordService := service.NewBackupRecordService(backupRecordRepo, backupExecutionService, logHub)
-	// 恢复服务：使用独立 LogHub 避免恢复记录与备份记录 ID 命名空间冲突
-	restoreRecordRepo := repository.NewRestoreRecordRepository(db)
-	restoreLogHub := backup.NewLogHub()
 	dashboardService := service.NewDashboardService(backupTaskRepo, backupRecordRepo, storageTargetRepo)
-	reportService := service.NewReportService(backupTaskRepo, backupRecordRepo)
 	settingsService := service.NewSettingsService(systemConfigRepo)

 	// Audit
@@ -112,18 +105,12 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,
 	auditService := service.NewAuditService(auditLogRepo)
 	authService.SetAuditService(auditService)
 	schedulerService.SetAuditRecorder(auditService)
-	// 审计日志外输：启动时用当前 settings 初始化 webhook，后续前端修改立即生效
-	settingsService.SetAuditWebhookConfigurer(ctx, auditService)
-	// 审计日志保留期清理：每 6h 读取 audit_retention_days 设置并清理超期日志（0/缺省=永久保留）
-	auditService.StartRetentionMonitor(ctx, systemConfigRepo, 6*time.Hour)

-	// Database discovery（集群依赖在 agentService 创建后注入）
+	// Database discovery
 	databaseDiscoveryService := service.NewDatabaseDiscoveryService(backup.NewOSCommandExecutor())

 	// Cluster: Node management
 	nodeRepo := repository.NewNodeRepository(db)
-	backupTaskService.SetNodeRepository(nodeRepo)
-	schedulerService.SetNodeRepository(nodeRepo)
 	nodeService := service.NewNodeService(nodeRepo, version)
 	nodeService.SetTaskRepository(backupTaskRepo)
 	if err := nodeService.EnsureLocalNode(ctx); err != nil {
@@ -134,9 +121,7 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,

 	// Agent 协议服务：命令队列 + 任务下发 + 记录上报
 	agentCmdRepo := repository.NewAgentCommandRepository(db)
-	nodeService.SetAgentCommandRepository(agentCmdRepo)
 	agentService := service.NewAgentService(nodeRepo, backupTaskRepo, backupRecordRepo, storageTargetRepo, agentCmdRepo, configCipher)
-	agentService.SetRestoreRepository(restoreRecordRepo)
 	agentService.StartCommandTimeoutMonitor(ctx, 30*time.Second, 10*time.Minute)

 	// 一键部署：install token service + 后台 GC
@@ -148,142 +133,30 @@ func New(ctx context.Context, cfg config.Config, version string) (*Application,
 	backupExecutionService.SetClusterDependencies(nodeRepo, agentService)
 	// 启用远程目录浏览：NodeService 通过 AgentService 做同步 RPC
 	nodeService.SetAgentRPC(agentService)
-	// 启用远程数据库发现：远程节点任务配置时 DatabasePicker 拿到的是节点视角的 DB 列表
-	databaseDiscoveryService.SetClusterDependencies(nodeRepo, agentService)
-
-	// 恢复服务：集群感知（本地/远程路由），依赖 agentService 入队
-	restoreService := service.NewRestoreService(
-		restoreRecordRepo,
-		backupRecordRepo,
-		backupTaskRepo,
-		storageTargetRepo,
-		nodeRepo,
-		storageRegistry,
-		backupRunnerRegistry,
-		restoreLogHub,
-		configCipher,
-		agentService,
-		cfg.Backup.TempDir,
-		cfg.Backup.MaxConcurrent,
-	)
-
-	// 验证服务：定期校验备份可恢复性（企业合规刚需）
-	verificationRecordRepo := repository.NewVerificationRecordRepository(db)
-	verifyLogHub := backup.NewLogHub()
-	verificationService := service.NewVerificationService(
-		verificationRecordRepo,
-		backupRecordRepo,
-		backupTaskRepo,
-		storageTargetRepo,
-		nodeRepo,
-		storageRegistry,
-		verifyLogHub,
-		configCipher,
-		cfg.Backup.TempDir,
-		cfg.Backup.MaxConcurrent,
-	)
-	// 验证失败通知：通过 NotificationService 的事件总线派发 verify_failed
-	verificationService.SetNotifier(service.NewVerificationEventNotifier(notificationService))
-	// 恢复完成/失败事件派发（restore_success / restore_failed）
-	restoreService.SetEventDispatcher(notificationService)
-	// 调度器接入验证演练 cron
-	schedulerService.SetVerifyRunner(verificationService)
-
-	// 用户管理与 API Key 服务（企业级 RBAC）
-	userService := service.NewUserService(userRepo)
-	apiKeyRepo := repository.NewApiKeyRepository(db)
-	apiKeyService := service.NewApiKeyService(apiKeyRepo)
-
-	// SLA 后台扫描：每 15 分钟扫描违约任务，同任务 6 小时内不重复派发
-	dashboardService.StartSLAMonitor(ctx, notificationService, 15*time.Minute, 6*time.Hour)
-	// 存储目标健康扫描：每 5 分钟测试启用目标，掉线即告警
-	storageTargetService.StartHealthMonitor(ctx, notificationService, 5*time.Minute)
-
-	// 备份复制服务（3-2-1 规则核心）
-	replicationRecordRepo := repository.NewReplicationRecordRepository(db)
-	replicationService := service.NewReplicationService(
-		replicationRecordRepo, backupRecordRepo, storageTargetRepo,
-		nodeRepo, storageRegistry, configCipher,
-		cfg.Backup.TempDir, cfg.Backup.MaxConcurrent,
-	)
-	replicationService.SetEventDispatcher(notificationService)
-	backupExecutionService.SetReplicationTrigger(replicationService)
-	// 备份成功后触发下游依赖任务（任务依赖链工作流）
-	backupExecutionService.SetDependentsResolver(backupTaskService)
-
-	// 任务模板（批量创建）
-	taskTemplateRepo := repository.NewTaskTemplateRepository(db)
-	taskTemplateService := service.NewTaskTemplateService(taskTemplateRepo, backupTaskService)
-
-	// 任务配置导入/导出（JSON，集群迁移 & 灾备）
-	taskExportService := service.NewTaskExportService(backupTaskService, backupTaskRepo, storageTargetRepo, nodeRepo)
-
-	// 全局搜索（跨任务/存储/节点/最近记录）
-	searchService := service.NewSearchService(backupTaskRepo, backupRecordRepo, storageTargetRepo, nodeRepo)
-
-	// 实时事件广播器（SSE 推送给前端 Dashboard）
-	// 注入 notification 后，每次 DispatchEvent 同时 broadcast 到所有 SSE 订阅者
-	eventBroadcaster := service.NewEventBroadcaster()
-	notificationService.SetBroadcaster(eventBroadcaster)
-
-	// 集群版本监控：每 30 分钟扫描，节点 24 小时内只告警一次
-	clusterVersionMonitor := service.NewClusterVersionMonitor(nodeRepo, version)
-	clusterVersionMonitor.SetEventDispatcher(notificationService)
-	clusterVersionMonitor.Start(ctx, 30*time.Minute, 24*time.Hour)
-
-	// Dashboard 集群概览依赖注入
-	dashboardService.SetClusterDependencies(nodeRepo, version)
-
-	// Prometheus 指标采集：Counter/Histogram 由业务服务实时写入；
-	// Gauge 类（存储用量、节点在线、SLA 违约）由 Collector 每 30s 异步刷新，
-	// 避免 /metrics 请求路径做慢 IO。
-	appMetrics := metrics.New(version)
-	backupExecutionService.SetMetrics(appMetrics)
-	restoreService.SetMetrics(appMetrics)
-	verificationService.SetMetrics(appMetrics)
-	replicationService.SetMetrics(appMetrics)
-	metricsCollector := metrics.NewCollector(
-		appMetrics,
-		metrics.NewRepoSource(storageTargetRepo, backupRecordRepo, nodeRepo, backupTaskRepo, agentCmdRepo),
-		30*time.Second,
-	)
-	metricsCollector.Start(ctx)

 	router := aphttp.NewRouter(aphttp.RouterDependencies{
-		Context:                  ctx,
-		Config:                   cfg,
-		Version:                  version,
-		Logger:                   appLogger,
-		AuthService:              authService,
-		SystemService:            systemService,
-		StorageTargetService:     storageTargetService,
-		BackupTaskService:        backupTaskService,
-		BackupExecutionService:   backupExecutionService,
-		BackupRecordService:      backupRecordService,
-		RestoreService:           restoreService,
-		VerificationService:      verificationService,
-		ReplicationService:       replicationService,
-		TaskTemplateService:      taskTemplateService,
-		TaskExportService:        taskExportService,
-		SearchService:            searchService,
-		EventBroadcaster:         eventBroadcaster,
-		UserService:              userService,
-		ApiKeyService:            apiKeyService,
-		NotificationService:      notificationService,
-		DashboardService:         dashboardService,
-		ReportService:            reportService,
-		SettingsService:          settingsService,
+		Context:                ctx,
+		Config:                 cfg,
+		Version:                version,
+		Logger:                 appLogger,
+		AuthService:            authService,
+		SystemService:          systemService,
+		StorageTargetService:   storageTargetService,
+		BackupTaskService:      backupTaskService,
+		BackupExecutionService: backupExecutionService,
+		BackupRecordService:    backupRecordService,
+		NotificationService:    notificationService,
+		DashboardService:       dashboardService,
+		SettingsService:        settingsService,
 		NodeService:              nodeService,
 		AgentService:             agentService,
 		DatabaseDiscoveryService: databaseDiscoveryService,
-		AuditService:             auditService,
+		AuditService:            auditService,
 		JWTManager:               jwtManager,
 		UserRepository:           userRepo,
 		SystemConfigRepo:         systemConfigRepo,
 		InstallTokenService:      installTokenService,
-		MasterExternalURL:        cfg.Server.ExternalURL,
-		DB:                       db,
-		Metrics:                  appMetrics,
+		MasterExternalURL:        "", // 如需覆盖 URL，可扩展 cfg.Server 增字段；目前留空依赖 X-Forwarded-* / Request.Host
 	})

 	httpServer := &stdhttp.Server{
--- a/server/internal/backup/discover.go
+++ b/server/internal/backup/discover.go
@@ -1,119 +0,0 @@
-package backup
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"strings"
-	"time"
-)
-
-// DiscoverRequest 数据库发现请求参数。
-// Type 取 "mysql" 或 "postgresql"。
-type DiscoverRequest struct {
-	Type     string
-	Host     string
-	Port     int
-	User     string
-	Password string
-}
-
-// DiscoverDatabases 通过本机 mysql/psql 客户端连接目标数据库并列出非系统库。
-// 5 秒命令超时。调用方负责传入 CommandExecutor（Master 用 OSCommandExecutor，
-// Agent 同理）。此函数不依赖 service / apperror，便于在 agent 包复用。
-func DiscoverDatabases(ctx context.Context, executor CommandExecutor, req DiscoverRequest) ([]string, error) {
-	switch strings.TrimSpace(strings.ToLower(req.Type)) {
-	case "mysql":
-		return discoverMySQLDatabases(ctx, executor, req)
-	case "postgresql":
-		return discoverPostgreSQLDatabases(ctx, executor, req)
-	default:
-		return nil, fmt.Errorf("unsupported database type: %s", req.Type)
-	}
-}
-
-func discoverMySQLDatabases(ctx context.Context, executor CommandExecutor, req DiscoverRequest) ([]string, error) {
-	mysqlPath, err := executor.LookPath("mysql")
-	if err != nil {
-		return nil, fmt.Errorf("系统未安装 mysql 客户端")
-	}
-	timeout, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-	var stdout, stderr bytes.Buffer
-	args := []string{
-		fmt.Sprintf("--host=%s", req.Host),
-		fmt.Sprintf("--port=%d", req.Port),
-		fmt.Sprintf("--user=%s", req.User),
-		"-e", "SHOW DATABASES",
-		"--skip-column-names",
-	}
-	env := []string{fmt.Sprintf("MYSQL_PWD=%s", req.Password)}
-	if err := executor.Run(timeout, mysqlPath, args, CommandOptions{
-		Stdout: &stdout,
-		Stderr: &stderr,
-		Env:    env,
-	}); err != nil {
-		errMsg := strings.TrimSpace(stderr.String())
-		if errMsg == "" {
-			errMsg = err.Error()
-		}
-		return nil, fmt.Errorf("连接 MySQL 失败：%s", errMsg)
-	}
-	systemDBs := map[string]bool{
-		"information_schema": true,
-		"performance_schema": true,
-		"mysql":              true,
-		"sys":                true,
-	}
-	var databases []string
-	for _, line := range strings.Split(stdout.String(), "\n") {
-		db := strings.TrimSpace(line)
-		if db == "" || systemDBs[db] {
-			continue
-		}
-		databases = append(databases, db)
-	}
-	return databases, nil
-}
-
-func discoverPostgreSQLDatabases(ctx context.Context, executor CommandExecutor, req DiscoverRequest) ([]string, error) {
-	psqlPath, err := executor.LookPath("psql")
-	if err != nil {
-		return nil, fmt.Errorf("系统未安装 psql 客户端")
-	}
-	timeout, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-	var stdout, stderr bytes.Buffer
-	args := []string{
-		"-h", req.Host,
-		"-p", fmt.Sprintf("%d", req.Port),
-		"-U", req.User,
-		"-d", "postgres",
-		"-t", "-A",
-		"-c", "SELECT datname FROM pg_database WHERE datistemplate = false ORDER BY datname",
-	}
-	env := []string{fmt.Sprintf("PGPASSWORD=%s", req.Password)}
-	if err := executor.Run(timeout, psqlPath, args, CommandOptions{
-		Stdout: &stdout,
-		Stderr: &stderr,
-		Env:    env,
-	}); err != nil {
-		errMsg := strings.TrimSpace(stderr.String())
-		if errMsg == "" {
-			errMsg = err.Error()
-		}
-		return nil, fmt.Errorf("连接 PostgreSQL 失败：%s", errMsg)
-	}
-	skipDBs := map[string]bool{
-		"postgres": true,
-	}
-	var databases []string
-	for _, line := range strings.Split(stdout.String(), "\n") {
-		db := strings.TrimSpace(line)
-		if db == "" || skipDBs[db] || strings.HasPrefix(db, "template") {
-			continue
-		}
-		databases = append(databases, db)
-	}
-	return databases, nil
-}
--- a/server/internal/backup/file_runner.go
+++ b/server/internal/backup/file_runner.go
@@ -3,7 +3,6 @@ package backup
 import (
 	"archive/tar"
 	"context"
-	"encoding/json"
 	"fmt"
 	"io"
 	"os"
@@ -53,20 +52,6 @@ func (r *FileRunner) Run(_ context.Context, task TaskSpec, writer LogWriter) (*R
 	defer tw.Close()

 	excludes := normalizeExcludePatterns(task.ExcludePatterns)
-
-	// 差异备份：基于上次全量清单仅打包新增/变更条目并记录删除；
-	// 全量备份：记录完整清单（manifest）供后续差异比对。
-	differential := task.Differential && len(task.BaseManifest.Entries) > 0
-	baseIndex := map[string]ManifestEntry{}
-	seen := map[string]struct{}{}
-	var manifest *Manifest
-	if differential {
-		baseIndex = task.BaseManifest.index()
-		writer.WriteLine(fmt.Sprintf("差异备份模式：基线含 %d 个条目", len(baseIndex)))
-	} else {
-		manifest = &Manifest{Entries: make([]ManifestEntry, 0)}
-	}
-
 	totalFileCount := 0
 	totalDirCount := 0

@@ -103,16 +88,6 @@ func (r *FileRunner) Run(_ context.Context, task TaskSpec, writer LogWriter) (*R
 				return nil
 			}

-			entry := entryFromInfo(archiveName, currentInfo)
-			if differential {
-				seen[entry.Path] = struct{}{}
-				if !changedSince(baseIndex, entry) {
-					return nil // 自全量以来未变更，跳过
-				}
-			} else {
-				manifest.Entries = append(manifest.Entries, entry)
-			}
-
 			if currentInfo.IsDir() {
 				dirCount++
 				writer.WriteLine(fmt.Sprintf("📁 进入目录 %s", archiveName))
@@ -128,19 +103,13 @@ func (r *FileRunner) Run(_ context.Context, task TaskSpec, writer LogWriter) (*R
 			}

 			if currentInfo.Mode().IsRegular() {
-				// 每个文件在独立作用域内打开并关闭，避免在大目录树中累积打开的文件句柄。
-				if copyErr := func() error {
-					file, err := os.Open(currentPath)
-					if err != nil {
-						return err
-					}
-					defer file.Close()
-					if _, err := io.CopyN(tw, file, currentInfo.Size()); err != nil && err != io.EOF {
-						return err
-					}
-					return nil
-				}(); copyErr != nil {
-					return copyErr
+				file, err := os.Open(currentPath)
+				if err != nil {
+					return err
+				}
+				defer file.Close()
+				if _, err := io.CopyN(tw, file, currentInfo.Size()); err != nil && err != io.EOF {
+					return err
 				}
 				fileCount++
 				if fileCount%100 == 0 {
@@ -161,16 +130,10 @@ func (r *FileRunner) Run(_ context.Context, task TaskSpec, writer LogWriter) (*R
 		totalDirCount += dirCount
 	}

-	if differential {
-		deletions := deletedPaths(baseIndex, seen)
-		if err := writeDeletionsEntry(tw, deletions); err != nil {
-			return nil, err
-		}
-		writer.WriteLine(fmt.Sprintf("差异备份完成（%d 个目录、%d 个文件变更，删除 %d 项）", totalDirCount, totalFileCount, len(deletions)))
-	} else if len(sourcePaths) > 1 {
+	if len(sourcePaths) > 1 {
 		writer.WriteLine(fmt.Sprintf("全部源路径打包完成（共 %d 个目录，%d 个文件）", totalDirCount, totalFileCount))
 	}
-	return &RunResult{ArtifactPath: artifactPath, FileName: filepath.Base(artifactPath), TempDir: tempDir, Manifest: manifest}, nil
+	return &RunResult{ArtifactPath: artifactPath, FileName: filepath.Base(artifactPath), TempDir: tempDir}, nil
 }

 func (r *FileRunner) Restore(_ context.Context, task TaskSpec, artifactPath string, writer LogWriter) error {
@@ -188,7 +151,6 @@ func (r *FileRunner) Restore(_ context.Context, task TaskSpec, artifactPath stri
 	if err := os.MkdirAll(targetParent, 0o755); err != nil {
 		return fmt.Errorf("create restore parent: %w", err)
 	}
-	var pendingDeletions []string
 	tr := tar.NewReader(artifactFile)
 	for {
 		header, err := tr.Next()
@@ -198,27 +160,13 @@ func (r *FileRunner) Restore(_ context.Context, task TaskSpec, artifactPath stri
 		if err != nil {
 			return fmt.Errorf("read tar entry: %w", err)
 		}
-		// 差异归档的删除清单不落地，留待提取完成后统一应用（避免被同批新增条目误删）。
-		if header.Name == deletionsEntryName {
-			data, readErr := io.ReadAll(tr)
-			if readErr != nil {
-				return fmt.Errorf("read deletions entry: %w", readErr)
-			}
-			if jsonErr := json.Unmarshal(data, &pendingDeletions); jsonErr != nil {
-				return fmt.Errorf("parse deletions entry: %w", jsonErr)
-			}
-			continue
-		}
 		cleanName := path.Clean(strings.TrimSpace(header.Name))
 		if cleanName == "." || cleanName == "" {
 			continue
 		}
-		// 选择性恢复：仅提取被选中的文件/目录（及其子项）。
-		if len(task.SelectedPaths) > 0 && !pathSelected(cleanName, task.SelectedPaths) {
-			continue
-		}
-		targetPath, ok := resolveWithinParent(targetParent, cleanName)
-		if !ok {
+		targetPath := filepath.Clean(filepath.Join(targetParent, filepath.FromSlash(cleanName)))
+		parentWithSep := filepath.Clean(targetParent) + string(filepath.Separator)
+		if targetPath != filepath.Clean(targetParent) && !strings.HasPrefix(targetPath, parentWithSep) {
 			return fmt.Errorf("tar entry escapes restore path")
 		}
 		switch header.Typeflag {
@@ -243,94 +191,10 @@ func (r *FileRunner) Restore(_ context.Context, task TaskSpec, artifactPath stri
 			}
 		}
 	}
-	// 选择性恢复时仅对选中范围应用删除，避免误删未选中的文件。
-	if len(task.SelectedPaths) > 0 {
-		pendingDeletions = filterSelectedPaths(pendingDeletions, task.SelectedPaths)
-	}
-	if err := applyDeletions(targetParent, pendingDeletions, writer); err != nil {
-		return err
-	}
 	writer.WriteLine("文件恢复完成")
 	return nil
 }

-// pathSelected 判断归档条目名是否落在选中集合内（精确匹配或位于选中目录之下）。
-func pathSelected(name string, selected []string) bool {
-	for _, sel := range selected {
-		clean := path.Clean(strings.TrimSpace(sel))
-		if clean == "" || clean == "." {
-			continue
-		}
-		if name == clean || strings.HasPrefix(name, clean+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// filterSelectedPaths 仅保留落在选中集合内的路径。
-func filterSelectedPaths(paths []string, selected []string) []string {
-	filtered := make([]string, 0, len(paths))
-	for _, p := range paths {
-		if pathSelected(path.Clean(strings.TrimSpace(p)), selected) {
-			filtered = append(filtered, p)
-		}
-	}
-	return filtered
-}
-
-// resolveWithinParent 将归档相对名安全解析为 targetParent 下的绝对路径；
-// 越界（路径穿越）时返回 ok=false。提取与删除共用此校验，杜绝逃逸。
-func resolveWithinParent(targetParent, name string) (string, bool) {
-	targetPath := filepath.Clean(filepath.Join(targetParent, filepath.FromSlash(name)))
-	cleanParent := filepath.Clean(targetParent)
-	if targetPath == cleanParent {
-		return targetPath, true
-	}
-	if !strings.HasPrefix(targetPath, cleanParent+string(filepath.Separator)) {
-		return "", false
-	}
-	return targetPath, true
-}
-
-// writeDeletionsEntry 将差异备份的删除路径列表写入归档特殊条目。
-func writeDeletionsEntry(tw *tar.Writer, deletions []string) error {
-	payload, err := json.Marshal(deletions)
-	if err != nil {
-		return fmt.Errorf("marshal deletions: %w", err)
-	}
-	header := &tar.Header{Name: deletionsEntryName, Mode: 0o600, Size: int64(len(payload)), Typeflag: tar.TypeReg}
-	if err := tw.WriteHeader(header); err != nil {
-		return fmt.Errorf("write deletions header: %w", err)
-	}
-	if _, err := tw.Write(payload); err != nil {
-		return fmt.Errorf("write deletions body: %w", err)
-	}
-	return nil
-}
-
-// applyDeletions 在基线恢复之上删除差异归档记录的路径（仅差异备份恢复时存在）。
-// 每个路径经 resolveWithinParent 校验，越界即报错；目标不存在视为已删除。
-func applyDeletions(targetParent string, deletions []string, writer LogWriter) error {
-	for _, name := range deletions {
-		clean := path.Clean(strings.TrimSpace(name))
-		if clean == "." || clean == "" {
-			continue
-		}
-		targetPath, ok := resolveWithinParent(targetParent, clean)
-		if !ok {
-			return fmt.Errorf("deletion entry escapes restore path")
-		}
-		if err := os.RemoveAll(targetPath); err != nil {
-			return fmt.Errorf("apply deletion %s: %w", clean, err)
-		}
-	}
-	if len(deletions) > 0 {
-		writer.WriteLine(fmt.Sprintf("已应用差异删除 %d 项", len(deletions)))
-	}
-	return nil
-}
-
 func normalizeExcludePatterns(items []string) []string {
 	result := make([]string, 0, len(items))
 	for _, item := range items {
--- a/server/internal/backup/file_runner_diff_test.go
+++ b/server/internal/backup/file_runner_diff_test.go
@@ -1,182 +0,0 @@
-package backup
-
-import (
-	"archive/tar"
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func diffWrite(t *testing.T, p, content string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-		t.Fatalf("mkdir %s: %v", filepath.Dir(p), err)
-	}
-	if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
-		t.Fatalf("write %s: %v", p, err)
-	}
-}
-
-func diffAssertContent(t *testing.T, p, want string) {
-	t.Helper()
-	got, err := os.ReadFile(p)
-	if err != nil {
-		t.Fatalf("read %s: %v", p, err)
-	}
-	if string(got) != want {
-		t.Fatalf("%s content = %q, want %q", p, string(got), want)
-	}
-}
-
-func diffAssertAbsent(t *testing.T, p string) {
-	t.Helper()
-	if _, err := os.Stat(p); !os.IsNotExist(err) {
-		t.Fatalf("expected %s to be absent, stat err=%v", p, err)
-	}
-}
-
-func diffArchiveNames(t *testing.T, artifactPath string) map[string]bool {
-	t.Helper()
-	f, err := os.Open(artifactPath)
-	if err != nil {
-		t.Fatalf("open artifact: %v", err)
-	}
-	defer f.Close()
-	names := map[string]bool{}
-	tr := tar.NewReader(f)
-	for {
-		h, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			t.Fatalf("read tar: %v", err)
-		}
-		names[h.Name] = true
-	}
-	return names
-}
-
-// TestFileRunnerDifferentialRoundTrip 验证差异备份的端到端正确性：
-// 全量 → 修改源（变更/删除/新增）→ 差异 → 链式恢复（全量+差异）→ 结果与修改后源一致。
-func TestFileRunnerDifferentialRoundTrip(t *testing.T) {
-	work := t.TempDir()
-	src := filepath.Join(work, "src")
-	diffWrite(t, filepath.Join(src, "a.txt"), "alpha")
-	diffWrite(t, filepath.Join(src, "b.txt"), "bravo")
-	diffWrite(t, filepath.Join(src, "sub", "c.txt"), "charlie")
-
-	runner := NewFileRunner()
-
-	full, err := runner.Run(context.Background(), TaskSpec{Name: "diff", Type: "file", SourcePath: src, TempDir: t.TempDir()}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("full Run: %v", err)
-	}
-	if full.Manifest == nil || len(full.Manifest.Entries) == 0 {
-		t.Fatalf("full backup must produce a manifest, got %#v", full.Manifest)
-	}
-
-	// 变更 a.txt（内容变长 → size 差异必被检出）、删除 b.txt、新增 d.txt；sub/c.txt 不变
-	diffWrite(t, filepath.Join(src, "a.txt"), "ALPHA-modified-and-longer")
-	if err := os.Remove(filepath.Join(src, "b.txt")); err != nil {
-		t.Fatalf("remove b.txt: %v", err)
-	}
-	diffWrite(t, filepath.Join(src, "d.txt"), "delta")
-
-	diff, err := runner.Run(context.Background(), TaskSpec{Name: "diff", Type: "file", SourcePath: src, TempDir: t.TempDir(), Differential: true, BaseManifest: *full.Manifest}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("differential Run: %v", err)
-	}
-	if diff.Manifest != nil {
-		t.Fatalf("differential backup must not produce a manifest")
-	}
-
-	// 差异归档应包含变更/新增条目与删除清单，但不含未变更的 sub/c.txt
-	names := diffArchiveNames(t, diff.ArtifactPath)
-	if !names["src/a.txt"] || !names["src/d.txt"] {
-		t.Fatalf("differential archive missing changed/new entries: %v", names)
-	}
-	if names["src/sub/c.txt"] {
-		t.Fatalf("differential archive should not contain unchanged file sub/c.txt")
-	}
-	if !names[deletionsEntryName] {
-		t.Fatalf("differential archive missing deletions entry: %v", names)
-	}
-
-	// 链式恢复到全新目标
-	restoreRoot := t.TempDir()
-	restoreSrc := filepath.Join(restoreRoot, "src")
-	restoreTask := TaskSpec{Name: "diff", Type: "file", SourcePath: restoreSrc}
-	if err := runner.Restore(context.Background(), restoreTask, full.ArtifactPath, NopLogWriter{}); err != nil {
-		t.Fatalf("restore full: %v", err)
-	}
-	if err := runner.Restore(context.Background(), restoreTask, diff.ArtifactPath, NopLogWriter{}); err != nil {
-		t.Fatalf("restore differential: %v", err)
-	}
-
-	diffAssertContent(t, filepath.Join(restoreSrc, "a.txt"), "ALPHA-modified-and-longer")
-	diffAssertContent(t, filepath.Join(restoreSrc, "sub", "c.txt"), "charlie")
-	diffAssertContent(t, filepath.Join(restoreSrc, "d.txt"), "delta")
-	diffAssertAbsent(t, filepath.Join(restoreSrc, "b.txt"))
-}
-
-func TestPathSelected(t *testing.T) {
-	sel := []string{"src/a.txt", "src/sub"}
-	cases := map[string]bool{
-		"src/a.txt":     true,
-		"src/sub":       true,
-		"src/sub/c.txt": true,  // 选中目录下的子项
-		"src/b.txt":     false, // 未选中文件
-		"src/subother":  false, // 前缀相近但非子项，不应误判
-	}
-	for name, want := range cases {
-		if got := pathSelected(name, sel); got != want {
-			t.Errorf("pathSelected(%q) = %v, want %v", name, got, want)
-		}
-	}
-}
-
-// TestFileRunnerSelectiveRestore 验证按需恢复：仅选中的文件与目录被还原，未选中的文件不出现。
-func TestFileRunnerSelectiveRestore(t *testing.T) {
-	work := t.TempDir()
-	src := filepath.Join(work, "src")
-	diffWrite(t, filepath.Join(src, "a.txt"), "alpha")
-	diffWrite(t, filepath.Join(src, "b.txt"), "bravo")
-	diffWrite(t, filepath.Join(src, "sub", "c.txt"), "charlie")
-
-	runner := NewFileRunner()
-	full, err := runner.Run(context.Background(), TaskSpec{Name: "sel", Type: "file", SourcePath: src, TempDir: t.TempDir()}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("full Run: %v", err)
-	}
-
-	restoreRoot := t.TempDir()
-	restoreSrc := filepath.Join(restoreRoot, "src")
-	task := TaskSpec{Name: "sel", Type: "file", SourcePath: restoreSrc, SelectedPaths: []string{"src/a.txt", "src/sub"}}
-	if err := runner.Restore(context.Background(), task, full.ArtifactPath, NopLogWriter{}); err != nil {
-		t.Fatalf("selective Restore: %v", err)
-	}
-	diffAssertContent(t, filepath.Join(restoreSrc, "a.txt"), "alpha")
-	diffAssertContent(t, filepath.Join(restoreSrc, "sub", "c.txt"), "charlie") // 选中目录 → 子项一并恢复
-	diffAssertAbsent(t, filepath.Join(restoreSrc, "b.txt"))                     // 未选中 → 不恢复
-}
-
-// TestFileRunnerDifferentialWithoutBaseIsFull 验证无基线时差异请求回退为全量（产出清单、含全部文件）。
-func TestFileRunnerDifferentialWithoutBaseIsFull(t *testing.T) {
-	src := filepath.Join(t.TempDir(), "src")
-	diffWrite(t, filepath.Join(src, "a.txt"), "alpha")
-
-	runner := NewFileRunner()
-	res, err := runner.Run(context.Background(), TaskSpec{Name: "diff", Type: "file", SourcePath: src, TempDir: t.TempDir(), Differential: true}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-	if res.Manifest == nil {
-		t.Fatalf("differential without base must fall back to full and produce a manifest")
-	}
-	if names := diffArchiveNames(t, res.ArtifactPath); !names["src/a.txt"] || names[deletionsEntryName] {
-		t.Fatalf("fallback-full archive unexpected: %v", names)
-	}
-}
--- a/server/internal/backup/manifest.go
+++ b/server/internal/backup/manifest.go
@@ -1,92 +0,0 @@
-package backup
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"sort"
-)
-
-// deletionsEntryName 是差异备份归档中记录「自全量以来被删除路径」的特殊条目名。
-// 恢复时该条目不落地为文件，而是用于在基线之上删除对应路径。
-const deletionsEntryName = ".backupx/deletions.json"
-
-// ManifestEntry 记录一次全量备份中单个归档条目（文件或目录）的指纹，
-// 供差异备份比对「自全量以来的变化」。Path 为归档内相对名（slash 分隔，
-// 与 tar header.Name 一致）。字段使用短键以压缩清单体积。
-type ManifestEntry struct {
-	Path      string `json:"p"`
-	Size      int64  `json:"s"`
-	ModTimeNs int64  `json:"m"`
-	Mode      uint32 `json:"o"`
-	IsDir     bool   `json:"d,omitempty"`
-}
-
-// Manifest 是一次全量备份的完整条目清单（文件与目录）。
-type Manifest struct {
-	Entries []ManifestEntry `json:"entries"`
-}
-
-// EncodeManifest 将清单序列化为紧凑 JSON。
-func EncodeManifest(m Manifest) ([]byte, error) {
-	return json.Marshal(m)
-}
-
-// DecodeManifest 反序列化清单；空输入返回空清单（视为「无基线」）。
-func DecodeManifest(data []byte) (Manifest, error) {
-	m := Manifest{}
-	if len(data) == 0 {
-		return m, nil
-	}
-	if err := json.Unmarshal(data, &m); err != nil {
-		return Manifest{}, err
-	}
-	return m, nil
-}
-
-// index 构建 path -> entry 映射，便于差异比对 O(1) 查找。
-func (m Manifest) index() map[string]ManifestEntry {
-	idx := make(map[string]ManifestEntry, len(m.Entries))
-	for _, e := range m.Entries {
-		idx[e.Path] = e
-	}
-	return idx
-}
-
-// entryFromInfo 由归档名与文件信息构造指纹条目。
-func entryFromInfo(archiveName string, info os.FileInfo) ManifestEntry {
-	return ManifestEntry{
-		Path:      filepath.ToSlash(archiveName),
-		Size:      info.Size(),
-		ModTimeNs: info.ModTime().UnixNano(),
-		Mode:      uint32(info.Mode().Perm()),
-		IsDir:     info.IsDir(),
-	}
-}
-
-// changedSince 判断当前条目相对基线是否为「新增或变更」（即应纳入差异归档）。
-//   - 不在基线中 → 新增，纳入；
-//   - 已存在的目录 → 不携带数据，跳过（其下变更文件会各自判定）；
-//   - 文件大小或 mtime 变化 → 变更，纳入（rsync 风格启发式）。
-func changedSince(base map[string]ManifestEntry, cur ManifestEntry) bool {
-	prev, ok := base[cur.Path]
-	if !ok {
-		return true
-	}
-	if cur.IsDir {
-		return false
-	}
-	return prev.Size != cur.Size || prev.ModTimeNs != cur.ModTimeNs
-}
-
-// deletedPaths 返回基线中存在、但本次遍历未出现的路径（被删除的条目），按路径升序。
-func deletedPaths(base map[string]ManifestEntry, seen map[string]struct{}) []string {
-	deleted := make([]string, 0)
-	for p := range base {
-		if _, ok := seen[p]; !ok {
-			deleted = append(deleted, p)
-		}
-	}
-	sort.Strings(deleted)
-	return deleted
-}
--- a/server/internal/backup/manifest_test.go
+++ b/server/internal/backup/manifest_test.go
@@ -1,79 +0,0 @@
-package backup
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestEncodeDecodeManifestRoundTrip(t *testing.T) {
-	m := Manifest{Entries: []ManifestEntry{
-		{Path: "src/a.txt", Size: 10, ModTimeNs: 100, Mode: 0o644},
-		{Path: "src", Size: 0, ModTimeNs: 50, Mode: 0o755, IsDir: true},
-	}}
-	data, err := EncodeManifest(m)
-	if err != nil {
-		t.Fatalf("EncodeManifest: %v", err)
-	}
-	got, err := DecodeManifest(data)
-	if err != nil {
-		t.Fatalf("DecodeManifest: %v", err)
-	}
-	if !reflect.DeepEqual(got, m) {
-		t.Fatalf("roundtrip mismatch:\n got %#v\nwant %#v", got, m)
-	}
-}
-
-func TestDecodeManifestEmpty(t *testing.T) {
-	got, err := DecodeManifest(nil)
-	if err != nil {
-		t.Fatalf("DecodeManifest(nil): %v", err)
-	}
-	if len(got.Entries) != 0 {
-		t.Fatalf("expected empty manifest, got %#v", got)
-	}
-}
-
-func TestChangedSince(t *testing.T) {
-	base := Manifest{Entries: []ManifestEntry{
-		{Path: "a.txt", Size: 10, ModTimeNs: 100},
-		{Path: "dir", IsDir: true, ModTimeNs: 100},
-	}}.index()
-
-	cases := []struct {
-		name string
-		cur  ManifestEntry
-		want bool
-	}{
-		{"unchanged file", ManifestEntry{Path: "a.txt", Size: 10, ModTimeNs: 100}, false},
-		{"size changed", ManifestEntry{Path: "a.txt", Size: 11, ModTimeNs: 100}, true},
-		{"mtime changed", ManifestEntry{Path: "a.txt", Size: 10, ModTimeNs: 200}, true},
-		{"new file", ManifestEntry{Path: "b.txt", Size: 1, ModTimeNs: 1}, true},
-		{"existing dir skipped", ManifestEntry{Path: "dir", IsDir: true, ModTimeNs: 999}, false},
-		{"new dir included", ManifestEntry{Path: "newdir", IsDir: true, ModTimeNs: 1}, true},
-	}
-	for _, tc := range cases {
-		if got := changedSince(base, tc.cur); got != tc.want {
-			t.Errorf("%s: changedSince=%v want %v", tc.name, got, tc.want)
-		}
-	}
-}
-
-func TestDeletedPaths(t *testing.T) {
-	base := Manifest{Entries: []ManifestEntry{
-		{Path: "a"}, {Path: "b"}, {Path: "c"},
-	}}.index()
-	seen := map[string]struct{}{"a": {}, "c": {}}
-	got := deletedPaths(base, seen)
-	want := []string{"b"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("deletedPaths=%v want %v", got, want)
-	}
-}
-
-func TestDeletedPathsNoneWhenAllSeen(t *testing.T) {
-	base := Manifest{Entries: []ManifestEntry{{Path: "a"}, {Path: "b"}}}.index()
-	seen := map[string]struct{}{"a": {}, "b": {}}
-	if got := deletedPaths(base, seen); len(got) != 0 {
-		t.Fatalf("expected no deletions, got %v", got)
-	}
-}
--- a/server/internal/backup/mongodb_runner.go
+++ b/server/internal/backup/mongodb_runner.go
@@ -1,119 +0,0 @@
-package backup
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// MongoDBRunner 通过 mongodump/mongorestore 备份与恢复 MongoDB 数据库。
-// 采用 --archive 流式模式（dump 写 stdout、restore 读 stdin），与 MySQLRunner
-// 的 mysqldump/mysql 管线保持一致；产物为未压缩的 mongo archive，由备份管线统一压缩/加密。
-type MongoDBRunner struct {
-	executor CommandExecutor
-}
-
-func NewMongoDBRunner(executor CommandExecutor) *MongoDBRunner {
-	if executor == nil {
-		executor = NewOSCommandExecutor()
-	}
-	return &MongoDBRunner{executor: executor}
-}
-
-func (r *MongoDBRunner) Type() string {
-	return "mongodb"
-}
-
-func (r *MongoDBRunner) Run(ctx context.Context, task TaskSpec, writer LogWriter) (*RunResult, error) {
-	if _, err := r.executor.LookPath("mongodump"); err != nil {
-		return nil, fmt.Errorf("未找到 mongodump 命令 (请确保服务器已安装 mongodb-database-tools)")
-	}
-	startedAt := task.StartedAt
-	if startedAt.IsZero() {
-		startedAt = time.Now().UTC()
-	}
-	tempDir, err := CreateTaskTempDir(task.Name, startedAt)
-	if err != nil {
-		return nil, err
-	}
-	fileName := BuildArtifactName(task.Name, startedAt, "archive")
-	artifactPath := filepath.Join(tempDir, fileName)
-	file, err := os.Create(artifactPath)
-	if err != nil {
-		return nil, fmt.Errorf("create mongodump archive file: %w", err)
-	}
-	defer file.Close()
-
-	args := mongoConnArgs(task.Database)
-	dbNames := normalizeDatabaseNames(task.Database.Names)
-	if len(dbNames) == 1 {
-		args = append(args, "--db", dbNames[0])
-		writer.WriteLine(fmt.Sprintf("备份数据库: %s", dbNames[0]))
-	} else {
-		writer.WriteLine("备份全部数据库")
-	}
-	args = append(args, "--archive") // 归档流式写入 stdout
-
-	writer.WriteLine(fmt.Sprintf("连接到 MongoDB: %s:%d", task.Database.Host, task.Database.Port))
-	stderrWriter := newLogLineWriter(writer, "mongodump")
-	writer.WriteLine("开始执行 mongodump")
-	if err := r.executor.Run(ctx, "mongodump", args, CommandOptions{Stdout: file, Stderr: stderrWriter}); err != nil {
-		return nil, fmt.Errorf("run mongodump: %w: %s", err, stderrWriter.collected())
-	}
-	info, err := file.Stat()
-	if err != nil {
-		return nil, fmt.Errorf("stat mongodump archive: %w", err)
-	}
-	if info.Size() == 0 {
-		return nil, fmt.Errorf("mongodump 产物为空，请检查数据库连接与权限")
-	}
-	writer.WriteLine(fmt.Sprintf("MongoDB 导出完成（文件大小: %s）", formatFileSize(info.Size())))
-	return &RunResult{ArtifactPath: artifactPath, FileName: fileName, TempDir: tempDir, Size: info.Size(), StorageKey: BuildStorageKey("mongodb", startedAt, fileName)}, nil
-}
-
-func (r *MongoDBRunner) Restore(ctx context.Context, task TaskSpec, artifactPath string, writer LogWriter) error {
-	if _, err := r.executor.LookPath("mongorestore"); err != nil {
-		return fmt.Errorf("未找到 mongorestore 命令 (请确保服务器已安装 mongodb-database-tools)")
-	}
-	input, err := os.Open(filepath.Clean(artifactPath))
-	if err != nil {
-		return fmt.Errorf("open mongodb restore archive: %w", err)
-	}
-	defer input.Close()
-
-	args := mongoConnArgs(task.Database)
-	// --drop：恢复前删除同名集合，保证恢复后与归档一致（与 mysql 恢复的整库覆盖语义对齐）。
-	args = append(args, "--drop", "--archive")
-	stderr := &bytes.Buffer{}
-	writer.WriteLine("开始执行 mongorestore")
-	if err := r.executor.Run(ctx, "mongorestore", args, CommandOptions{Stdin: input, Stderr: stderr}); err != nil {
-		return fmt.Errorf("run mongorestore: %w: %s", err, strings.TrimSpace(stderr.String()))
-	}
-	writer.WriteLine("MongoDB 恢复完成")
-	return nil
-}
-
-// mongoConnArgs 构造 mongodump/mongorestore 的连接与认证参数。
-// 注意：mongodb-database-tools 无类似 MYSQL_PWD 的密码环境变量，密码只能经 --password 传入；
-// 认证库默认 admin（绝大多数部署的管理账号所在库）。
-func mongoConnArgs(db DatabaseSpec) []string {
-	args := make([]string, 0, 8)
-	if strings.TrimSpace(db.Host) != "" {
-		args = append(args, "--host", db.Host)
-	}
-	if db.Port > 0 {
-		args = append(args, "--port", strconv.Itoa(db.Port))
-	}
-	if strings.TrimSpace(db.User) != "" {
-		args = append(args, "--username", db.User, "--authenticationDatabase", "admin")
-		if strings.TrimSpace(db.Password) != "" {
-			args = append(args, "--password", db.Password)
-		}
-	}
-	return args
-}
--- a/server/internal/backup/mongodb_runner_test.go
+++ b/server/internal/backup/mongodb_runner_test.go
@@ -1,102 +0,0 @@
-package backup
-
-import (
-	"context"
-	"errors"
-	"io"
-	"os"
-	"strings"
-	"testing"
-)
-
-func argIndex(args []string, target string) int {
-	for i, a := range args {
-		if a == target {
-			return i
-		}
-	}
-	return -1
-}
-
-func TestMongoDBRunnerRunUsesMongodump(t *testing.T) {
-	executor := &fakeCommandExecutor{runFunc: func(name string, args []string, options CommandOptions) error {
-		if options.Stdout != nil {
-			_, _ = io.WriteString(options.Stdout, "mongo archive bytes")
-		}
-		return nil
-	}}
-	runner := NewMongoDBRunner(executor)
-	result, err := runner.Run(context.Background(), TaskSpec{Name: "mongo", Type: "mongodb", Database: DatabaseSpec{Host: "127.0.0.1", Port: 27017, User: "admin", Password: "secret", Names: []string{"app"}}}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("Run returned error: %v", err)
-	}
-	if executor.lastName != "mongodump" {
-		t.Fatalf("expected mongodump, got %s", executor.lastName)
-	}
-	args := executor.lastArgs
-	if argIndex(args, "--archive") < 0 {
-		t.Fatalf("expected --archive flag, got %#v", args)
-	}
-	if i := argIndex(args, "--db"); i < 0 || i+1 >= len(args) || args[i+1] != "app" {
-		t.Fatalf("expected --db app, got %#v", args)
-	}
-	if i := argIndex(args, "--username"); i < 0 || args[i+1] != "admin" {
-		t.Fatalf("expected --username admin, got %#v", args)
-	}
-	if argIndex(args, "--authenticationDatabase") < 0 || argIndex(args, "--password") < 0 {
-		t.Fatalf("expected auth args, got %#v", args)
-	}
-	if _, err := os.Stat(result.ArtifactPath); err != nil {
-		t.Fatalf("artifact file missing: %v", err)
-	}
-	if result.StorageKey == "" || !strings.HasSuffix(result.FileName, ".archive") {
-		t.Fatalf("unexpected result metadata: %#v", result)
-	}
-}
-
-func TestMongoDBRunnerRunBackupsAllWhenNoDatabase(t *testing.T) {
-	executor := &fakeCommandExecutor{runFunc: func(name string, args []string, options CommandOptions) error {
-		_, _ = io.WriteString(options.Stdout, "all dbs")
-		return nil
-	}}
-	runner := NewMongoDBRunner(executor)
-	_, err := runner.Run(context.Background(), TaskSpec{Name: "mongo", Type: "mongodb", Database: DatabaseSpec{Host: "127.0.0.1", Port: 27017}}, NopLogWriter{})
-	if err != nil {
-		t.Fatalf("Run returned error: %v", err)
-	}
-	if argIndex(executor.lastArgs, "--db") >= 0 {
-		t.Fatalf("expected no --db when backing up all databases, got %#v", executor.lastArgs)
-	}
-}
-
-func TestMongoDBRunnerRunRejectsEmptyOutput(t *testing.T) {
-	executor := &fakeCommandExecutor{} // runFunc nil → writes nothing
-	runner := NewMongoDBRunner(executor)
-	_, err := runner.Run(context.Background(), TaskSpec{Name: "mongo", Type: "mongodb", Database: DatabaseSpec{Host: "127.0.0.1", Port: 27017, Names: []string{"app"}}}, NopLogWriter{})
-	if err == nil {
-		t.Fatal("expected error for empty mongodump output")
-	}
-}
-
-func TestMongoDBRunnerRestoreUsesMongorestore(t *testing.T) {
-	executor := &fakeCommandExecutor{}
-	runner := NewMongoDBRunner(executor)
-	artifact := filepathJoinTempFile(t, "dump.archive", "mongo archive bytes")
-	if err := runner.Restore(context.Background(), TaskSpec{Name: "mongo", Type: "mongodb", Database: DatabaseSpec{Host: "127.0.0.1", Port: 27017, User: "admin", Password: "secret"}}, artifact, NopLogWriter{}); err != nil {
-		t.Fatalf("Restore returned error: %v", err)
-	}
-	if executor.lastName != "mongorestore" {
-		t.Fatalf("expected mongorestore, got %s", executor.lastName)
-	}
-	if argIndex(executor.lastArgs, "--drop") < 0 || argIndex(executor.lastArgs, "--archive") < 0 {
-		t.Fatalf("expected --drop --archive, got %#v", executor.lastArgs)
-	}
-}
-
-func TestMongoDBRunnerRunReturnsLookupError(t *testing.T) {
-	runner := NewMongoDBRunner(&fakeCommandExecutor{lookupErr: errors.New("missing")})
-	_, err := runner.Run(context.Background(), TaskSpec{Name: "mongo", Type: "mongodb", Database: DatabaseSpec{Host: "127.0.0.1", Port: 27017, Names: []string{"app"}}}, NopLogWriter{})
-	if err == nil {
-		t.Fatal("expected error when mongodump is missing")
-	}
-}
--- a/server/internal/backup/retention/differential_test.go
+++ b/server/internal/backup/retention/differential_test.go
@@ -1,55 +0,0 @@
-package retention
-
-import (
-	"testing"
-
-	"backupx/server/internal/model"
-)
-
-func retentionRecIDs(records []model.BackupRecord) []uint {
-	ids := make([]uint, 0, len(records))
-	for _, r := range records {
-		ids = append(ids, r.ID)
-	}
-	return ids
-}
-
-// 基线全量仍被「不在删除集合中的差异」依赖 → 必须保留，否则差异无法恢复。
-func TestProtectDifferentialBasesKeepsBaseWithSurvivingDiff(t *testing.T) {
-	all := []model.BackupRecord{
-		{ID: 1, BackupKind: model.BackupKindFull},
-		{ID: 2, BackupKind: model.BackupKindDifferential, BaseRecordID: 1},
-	}
-	candidates := []model.BackupRecord{{ID: 1, BackupKind: model.BackupKindFull}}
-	if got := protectDifferentialBases(all, candidates); len(got) != 0 {
-		t.Fatalf("base with surviving diff must be protected, got %v", retentionRecIDs(got))
-	}
-}
-
-// 基线全量与其全部差异都在删除集合中 → 可一并删除（无残留差异失去基线）。
-func TestProtectDifferentialBasesDeletesBaseWhenDiffAlsoDeleted(t *testing.T) {
-	all := []model.BackupRecord{
-		{ID: 1, BackupKind: model.BackupKindFull},
-		{ID: 2, BackupKind: model.BackupKindDifferential, BaseRecordID: 1},
-	}
-	candidates := []model.BackupRecord{
-		{ID: 1, BackupKind: model.BackupKindFull},
-		{ID: 2, BackupKind: model.BackupKindDifferential, BaseRecordID: 1},
-	}
-	if got := protectDifferentialBases(all, candidates); len(got) != 2 {
-		t.Fatalf("base+diff both expired should both be deleted, got %v", retentionRecIDs(got))
-	}
-}
-
-// 无差异备份时原样透传（不影响既有全量保留逻辑）。
-func TestProtectDifferentialBasesNoDiffsPassThrough(t *testing.T) {
-	all := []model.BackupRecord{
-		{ID: 1, BackupKind: model.BackupKindFull},
-		{ID: 2, BackupKind: model.BackupKindFull},
-	}
-	candidates := []model.BackupRecord{{ID: 1, BackupKind: model.BackupKindFull}}
-	got := protectDifferentialBases(all, candidates)
-	if len(got) != 1 || got[0].ID != 1 {
-		t.Fatalf("no diffs should pass through unchanged, got %v", retentionRecIDs(got))
-	}
-}
--- a/server/internal/backup/retention/service.go
+++ b/server/internal/backup/retention/service.go
@@ -3,7 +3,6 @@ package retention
 import (
 	"context"
 	"fmt"
-	"sort"
 	"strings"
 	"time"

@@ -57,15 +56,7 @@ func (s *Service) Cleanup(ctx context.Context, task *model.BackupTask, provider
 	if err != nil {
 		return nil, fmt.Errorf("list successful records: %w", err)
 	}
-	var candidates []model.BackupRecord
-	if gfsEnabled(task) {
-		// GFS 策略：按天/周/月/年分层保留代表性备份，取代简单的天数/数量策略。
-		candidates = selectGFSToDelete(records, task.KeepDaily, task.KeepWeekly, task.KeepMonthly, task.KeepYearly)
-	} else {
-		candidates = selectRecordsToDelete(records, task.RetentionDays, task.MaxBackups, s.now())
-	}
-	// 差异链保护：保留仍被存活差异依赖的全量，避免删除基线后差异无法恢复。
-	candidates = protectDifferentialBases(records, candidates)
+	candidates := selectRecordsToDelete(records, task.RetentionDays, task.MaxBackups, s.now())
 	result := &CleanupResult{}
 	for _, record := range candidates {
 		if strings.TrimSpace(record.StoragePath) != "" {
@@ -99,50 +90,7 @@ func (s *Service) Cleanup(ctx context.Context, task *model.BackupTask, provider
 	return result, nil
 }

-// protectDifferentialBases 从删除候选中剔除「仍被存活差异依赖的全量」，
-// 避免删除基线后其差异备份失去依据、无法恢复。全量仅当其全部差异都已过期/删除时才会被清理。
-func protectDifferentialBases(all []model.BackupRecord, candidates []model.BackupRecord) []model.BackupRecord {
-	deleting := make(map[uint]struct{}, len(candidates))
-	for _, r := range candidates {
-		deleting[r.ID] = struct{}{}
-	}
-	protected := make(map[uint]struct{})
-	for _, r := range all {
-		if r.BackupKind != model.BackupKindDifferential || r.BaseRecordID == 0 {
-			continue
-		}
-		if _, beingDeleted := deleting[r.ID]; beingDeleted {
-			continue // 该差异本身也将被删除，无需保护其基线
-		}
-		protected[r.BaseRecordID] = struct{}{}
-	}
-	if len(protected) == 0 {
-		return candidates
-	}
-	filtered := make([]model.BackupRecord, 0, len(candidates))
-	for _, r := range candidates {
-		if r.BackupKind == model.BackupKindFull {
-			if _, keep := protected[r.ID]; keep {
-				continue
-			}
-		}
-		filtered = append(filtered, r)
-	}
-	return filtered
-}
-
 func selectRecordsToDelete(records []model.BackupRecord, retentionDays int, maxBackups int, now time.Time) []model.BackupRecord {
-	// 保留锁定（法律保留）的记录永不参与清理：先从候选集中剔除，
-	// 锁定备份既不被删除，也不占用 maxBackups 轮转名额。
-	if hasLocked(records) {
-		unlocked := make([]model.BackupRecord, 0, len(records))
-		for _, r := range records {
-			if !r.Locked {
-				unlocked = append(unlocked, r)
-			}
-		}
-		records = unlocked
-	}
 	selected := make(map[uint]model.BackupRecord)
 	if maxBackups > 0 && len(records) > maxBackups {
 		for _, record := range records[maxBackups:] {
@@ -165,81 +113,3 @@ func selectRecordsToDelete(records []model.BackupRecord, retentionDays int, maxB
 	}
 	return result
 }
-
-func hasLocked(records []model.BackupRecord) bool {
-	for i := range records {
-		if records[i].Locked {
-			return true
-		}
-	}
-	return false
-}
-
-// gfsEnabled 判定任务是否启用 GFS 分层保留（任一层级 > 0）。
-func gfsEnabled(task *model.BackupTask) bool {
-	return task.KeepDaily > 0 || task.KeepWeekly > 0 || task.KeepMonthly > 0 || task.KeepYearly > 0
-}
-
-func recordTime(r *model.BackupRecord) time.Time {
-	if r.CompletedAt != nil {
-		return *r.CompletedAt
-	}
-	return r.StartedAt
-}
-
-func isoWeekKey(t time.Time) string {
-	y, w := t.ISOWeek()
-	return fmt.Sprintf("%d-W%02d", y, w)
-}
-
-// selectGFSToDelete 按 GFS（祖父-父-子）策略选出应删除的记录。
-//
-// 规则：对每个层级（天/周/月/年），在按时间降序排列后，保留最近 keep 个不同周期中
-// 每个周期最新的一份备份；各层级保留集合取并集即「保留集」，其余删除。
-// 锁定（法律保留）的记录始终排除在删除候选之外。
-func selectGFSToDelete(records []model.BackupRecord, daily, weekly, monthly, yearly int) []model.BackupRecord {
-	active := make([]model.BackupRecord, 0, len(records))
-	for i := range records {
-		if !records[i].Locked {
-			active = append(active, records[i])
-		}
-	}
-	sort.SliceStable(active, func(i, j int) bool {
-		return recordTime(&active[i]).After(recordTime(&active[j]))
-	})
-
-	keep := make(map[uint]bool, len(active))
-	keepTier := func(count int, key func(time.Time) string) {
-		if count <= 0 {
-			return
-		}
-		periods := 0
-		lastPeriod := ""
-		havePrev := false
-		for i := range active {
-			p := key(recordTime(&active[i]))
-			if havePrev && p == lastPeriod {
-				continue // 同周期已保留代表（最新一份）
-			}
-			if periods >= count {
-				break // 该层级已保留足够多的周期
-			}
-			keep[active[i].ID] = true
-			lastPeriod = p
-			havePrev = true
-			periods++
-		}
-	}
-	keepTier(daily, func(t time.Time) string { return t.Format("2006-01-02") })
-	keepTier(weekly, isoWeekKey)
-	keepTier(monthly, func(t time.Time) string { return t.Format("2006-01") })
-	keepTier(yearly, func(t time.Time) string { return t.Format("2006") })
-
-	del := make([]model.BackupRecord, 0)
-	for i := range active {
-		if !keep[active[i].ID] {
-			del = append(del, active[i])
-		}
-	}
-	return del
-}
--- a/server/internal/backup/retention/service_test.go
+++ b/server/internal/backup/retention/service_test.go
@@ -24,9 +24,6 @@ func (r *fakeRecordRepository) List(context.Context, repository.BackupRecordList
 func (r *fakeRecordRepository) FindByID(context.Context, uint) (*model.BackupRecord, error) {
 	return nil, nil
 }
-func (r *fakeRecordRepository) FindRunningByTaskAndNode(context.Context, uint, uint) (*model.BackupRecord, error) {
-	return nil, nil
-}
 func (r *fakeRecordRepository) Create(context.Context, *model.BackupRecord) error { return nil }
 func (r *fakeRecordRepository) Update(context.Context, *model.BackupRecord) error { return nil }
 func (r *fakeRecordRepository) Delete(_ context.Context, id uint) error {
@@ -45,9 +42,6 @@ func (r *fakeRecordRepository) ListByTask(_ context.Context, _ uint) ([]model.Ba
 func (r *fakeRecordRepository) ListSuccessfulByTask(_ context.Context, _ uint) ([]model.BackupRecord, error) {
 	return r.records, nil
 }
-func (r *fakeRecordRepository) CountDependentDifferentials(context.Context, uint) (int64, error) {
-	return 0, nil
-}
 func (r *fakeRecordRepository) Count(context.Context) (int64, error)                 { return 0, nil }
 func (r *fakeRecordRepository) CountSince(context.Context, time.Time) (int64, error) { return 0, nil }
 func (r *fakeRecordRepository) CountSuccessSince(context.Context, time.Time) (int64, error) {
@@ -96,105 +90,6 @@ func TestSelectRecordsToDelete(t *testing.T) {
 	}
 }

-func gfsRecord(id uint, ts time.Time, locked bool) model.BackupRecord {
-	completed := ts
-	return model.BackupRecord{ID: id, StartedAt: ts, CompletedAt: &completed, Locked: locked}
-}
-
-func gfsDay(y, m, d, h int) time.Time {
-	return time.Date(y, time.Month(m), d, h, 0, 0, 0, time.UTC)
-}
-
-func deletedIDSet(records []model.BackupRecord) map[uint]bool {
-	out := make(map[uint]bool, len(records))
-	for i := range records {
-		out[records[i].ID] = true
-	}
-	return out
-}
-
-func assertDeleted(t *testing.T, del []model.BackupRecord, want ...uint) {
-	t.Helper()
-	got := deletedIDSet(del)
-	if len(got) != len(want) {
-		t.Fatalf("deleted set size = %d %v, want %d %v", len(got), got, len(want), want)
-	}
-	for _, id := range want {
-		if !got[id] {
-			t.Fatalf("expected id %d to be deleted; got %v", id, got)
-		}
-	}
-}
-
-// TestSelectGFSToDelete_DailyTier 验证按天分层：每天仅保留最新一份，且只保留最近 N 天。
-func TestSelectGFSToDelete_DailyTier(t *testing.T) {
-	records := []model.BackupRecord{
-		gfsRecord(5, gfsDay(2026, 3, 7, 12), false), // 今天，最新 → 保留
-		gfsRecord(4, gfsDay(2026, 3, 7, 6), false),  // 今天，较早 → 删除（非当天代表）
-		gfsRecord(3, gfsDay(2026, 3, 6, 12), false), // 昨天 → 保留
-		gfsRecord(2, gfsDay(2026, 3, 5, 12), false), // 前天 → 超出 daily=2 → 删除
-		gfsRecord(1, gfsDay(2026, 3, 4, 12), false), // 更早 → 删除
-	}
-	del := selectGFSToDelete(records, 2, 0, 0, 0)
-	assertDeleted(t, del, 4, 2, 1)
-}
-
-// TestSelectGFSToDelete_TierUnion 验证多层级取并集：月度层级保留日度层级会删除的旧备份。
-func TestSelectGFSToDelete_TierUnion(t *testing.T) {
-	records := []model.BackupRecord{
-		gfsRecord(3, gfsDay(2026, 3, 7, 12), false),  // 3 月（最新）
-		gfsRecord(2, gfsDay(2026, 2, 15, 12), false), // 2 月
-		gfsRecord(1, gfsDay(2026, 1, 15, 12), false), // 1 月
-	}
-	// daily=1 只留 ID3；monthly=2 留最近两个月（3 月=ID3、2 月=ID2）。并集={3,2}，删除 ID1。
-	del := selectGFSToDelete(records, 1, 0, 2, 0)
-	assertDeleted(t, del, 1)
-}
-
-// TestSelectGFSToDelete_SkipsLocked 验证锁定记录即使超出所有层级也永不删除。
-func TestSelectGFSToDelete_SkipsLocked(t *testing.T) {
-	records := []model.BackupRecord{
-		gfsRecord(3, gfsDay(2026, 3, 7, 12), false),
-		gfsRecord(2, gfsDay(2026, 3, 6, 12), false),
-		gfsRecord(1, gfsDay(2020, 1, 1, 12), true), // 远超 daily=1 但已锁定 → 不删
-	}
-	del := selectGFSToDelete(records, 1, 0, 0, 0)
-	assertDeleted(t, del, 2) // 仅 ID2 被删；ID1 锁定豁免，ID3 为当日代表
-}
-
-func TestGFSEnabled(t *testing.T) {
-	if gfsEnabled(&model.BackupTask{}) {
-		t.Fatal("empty GFS config should be disabled")
-	}
-	if !gfsEnabled(&model.BackupTask{KeepWeekly: 4}) {
-		t.Fatal("KeepWeekly>0 should enable GFS")
-	}
-}
-
-// TestSelectRecordsToDelete_SkipsLocked 验证保留锁定（法律保留）的记录永不被选中删除，
-// 即使它既超过保留期、又超过 maxBackups 名额。
-func TestSelectRecordsToDelete_SkipsLocked(t *testing.T) {
-	now := time.Date(2026, 3, 7, 16, 0, 0, 0, time.UTC)
-	completedNew := now.Add(-24 * time.Hour)
-	completedOld := now.Add(-15 * 24 * time.Hour)
-	records := []model.BackupRecord{
-		{ID: 3, CompletedAt: &completedNew},
-		{ID: 2, CompletedAt: &completedNew},
-		{ID: 1, CompletedAt: &completedOld, Locked: true}, // 超期但锁定 → 不应删除
-	}
-	selected := selectRecordsToDelete(records, 7, 2, now)
-	for _, r := range selected {
-		if r.ID == 1 {
-			t.Fatalf("locked record #1 must never be selected for deletion: %#v", selected)
-		}
-	}
-	// 锁定记录不占 maxBackups 名额：未锁定仅 2 条，maxBackups=2 → 无超额删除，
-	// 且无未锁定记录超期 → 选中集为空。
-	if len(selected) != 0 {
-		t.Fatalf("expected no deletions (locked excluded), got %#v", selected)
-	}
-}
-
 func TestCleanupDeletesExpiredRecords(t *testing.T) {
 	now := time.Date(2026, 3, 7, 16, 0, 0, 0, time.UTC)
 	completedNew := now.Add(-24 * time.Hour)
--- a/server/internal/backup/types.go
+++ b/server/internal/backup/types.go
@@ -36,12 +36,6 @@ type TaskSpec struct {
 	MaxBackups        int
 	StartedAt         time.Time
 	TempDir           string
-	// Differential 为 true 时执行差异备份：仅打包自 BaseManifest 以来新增/变更的条目，
-	// 并记录被删除的路径。仅文件类型任务支持；BaseManifest 为空时回退为全量。
-	Differential bool
-	BaseManifest Manifest
-	// SelectedPaths 非空时仅恢复这些归档相对路径（及其子项），用于按需（选择性）恢复；仅文件类型生效。
-	SelectedPaths []string
 }

 type RunResult struct {
@@ -50,8 +44,6 @@ type RunResult struct {
 	TempDir      string
 	Size         int64
 	StorageKey   string
-	// Manifest 为全量备份产出的条目清单，供后续差异备份比对；差异备份运行时为 nil。
-	Manifest *Manifest
 }

 type LogEvent struct {
@@ -70,7 +62,7 @@ type ProgressInfo struct {
 	BytesSent  int64   `json:"bytesSent"`
 	TotalBytes int64   `json:"totalBytes"`
 	Percent    float64 `json:"percent"`
-	SpeedBps   float64 `json:"speedBps"` // bytes/sec
+	SpeedBps   float64 `json:"speedBps"`   // bytes/sec
 	TargetName string  `json:"targetName"`
 }

--- a/server/internal/backup/verify.go
+++ b/server/internal/backup/verify.go
@@ -1,179 +0,0 @@
-package backup
-
-import (
-	"archive/tar"
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-)
-
-// VerifyReport 是 quick 模式的验证结果摘要。
-type VerifyReport struct {
-	TotalEntries int    `json:"totalEntries,omitempty"`
-	FileBytes    int64  `json:"fileBytes,omitempty"`
-	ChecksumOK   bool   `json:"checksumOk,omitempty"`
-	Detail       string `json:"detail,omitempty"`
-}
-
-// VerifyTarArchive 遍历 tar 归档的每个 header + reader，不写盘。
-// 能检测归档截断、条目损坏、层级不对等常见问题。
-// expectedChecksum 非空时额外对整个文件校验 SHA-256（不做解压）。
-func VerifyTarArchive(artifactPath string, expectedChecksum string) (*VerifyReport, error) {
-	file, err := os.Open(artifactPath)
-	if err != nil {
-		return nil, fmt.Errorf("open tar artifact: %w", err)
-	}
-	defer file.Close()
-	report := &VerifyReport{}
-	h := sha256.New()
-	reader := io.TeeReader(file, h)
-	tr := tar.NewReader(reader)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return report, fmt.Errorf("read tar entry: %w", err)
-		}
-		report.TotalEntries++
-		// 读完条目数据以触发完整性校验（tar 内部 CRC 不严格，但断流会报错）
-		if header.Typeflag == tar.TypeReg || header.Typeflag == tar.TypeRegA {
-			n, copyErr := io.Copy(io.Discard, tr)
-			if copyErr != nil {
-				return report, fmt.Errorf("read entry %s: %w", header.Name, copyErr)
-			}
-			report.FileBytes += n
-		}
-	}
-	// 读完 tar 后继续把剩余字节喂给 hash（tar 结束后可能有零填充尾）
-	if _, err := io.Copy(io.Discard, reader); err != nil {
-		return report, fmt.Errorf("drain remainder: %w", err)
-	}
-	actual := hex.EncodeToString(h.Sum(nil))
-	if strings.TrimSpace(expectedChecksum) != "" {
-		report.ChecksumOK = strings.EqualFold(actual, expectedChecksum)
-		if !report.ChecksumOK {
-			return report, fmt.Errorf("checksum mismatch: expected %s, got %s", expectedChecksum, actual)
-		}
-	} else {
-		report.ChecksumOK = true
-	}
-	report.Detail = fmt.Sprintf("tar 包完整（%d 条目，有效字节 %d）", report.TotalEntries, report.FileBytes)
-	return report, nil
-}
-
-// VerifySQLiteFile 校验 SQLite 文件头魔数。
-// 官方格式：前 16 字节为 "SQLite format 3\000"。
-func VerifySQLiteFile(artifactPath string) (*VerifyReport, error) {
-	file, err := os.Open(artifactPath)
-	if err != nil {
-		return nil, fmt.Errorf("open sqlite artifact: %w", err)
-	}
-	defer file.Close()
-	header := make([]byte, 16)
-	if _, err := io.ReadFull(file, header); err != nil {
-		return nil, fmt.Errorf("read sqlite header: %w", err)
-	}
-	const magic = "SQLite format 3\x00"
-	if string(header) != magic {
-		return &VerifyReport{Detail: "非法的 SQLite 文件头"}, fmt.Errorf("invalid sqlite magic header")
-	}
-	info, _ := file.Stat()
-	var size int64
-	if info != nil {
-		size = info.Size()
-	}
-	return &VerifyReport{
-		FileBytes: size,
-		Detail:    fmt.Sprintf("SQLite 文件头合法（总大小 %d 字节）", size),
-	}, nil
-}
-
-// VerifyMySQLDump 校验 MySQL dump 文件头部是否为合法 mysqldump 输出。
-// 头部 1024 字节包含以下任一关键字即通过：
-//   - "-- MySQL dump"
-//   - "-- Server version"
-//   - "-- MariaDB dump"
-func VerifyMySQLDump(artifactPath string) (*VerifyReport, error) {
-	return verifyDumpHeader(artifactPath, []string{"-- MySQL dump", "-- Server version", "-- MariaDB dump"}, "MySQL/MariaDB")
-}
-
-// VerifyPostgreSQLDump 校验 PostgreSQL plain text dump 头部。
-// 典型标记："-- PostgreSQL database dump" 或 "-- Dumped from database version"。
-func VerifyPostgreSQLDump(artifactPath string) (*VerifyReport, error) {
-	return verifyDumpHeader(artifactPath, []string{"-- PostgreSQL database dump", "-- Dumped from database version", "SET statement_timeout"}, "PostgreSQL")
-}
-
-func verifyDumpHeader(artifactPath string, markers []string, label string) (*VerifyReport, error) {
-	file, err := os.Open(artifactPath)
-	if err != nil {
-		return nil, fmt.Errorf("open dump artifact: %w", err)
-	}
-	defer file.Close()
-	reader := bufio.NewReader(file)
-	buf := make([]byte, 4096)
-	n, _ := io.ReadFull(reader, buf)
-	sample := string(buf[:n])
-	matched := ""
-	for _, m := range markers {
-		if strings.Contains(sample, m) {
-			matched = m
-			break
-		}
-	}
-	if matched == "" {
-		return &VerifyReport{Detail: fmt.Sprintf("未在前 %d 字节中发现 %s dump 特征", n, label)}, fmt.Errorf("no %s dump marker in header", label)
-	}
-	info, _ := file.Stat()
-	var size int64
-	if info != nil {
-		size = info.Size()
-	}
-	return &VerifyReport{
-		FileBytes: size,
-		Detail:    fmt.Sprintf("%s dump 头部识别标志: %q（文件 %d 字节）", label, matched, size),
-	}, nil
-}
-
-// VerifySAPHANAArchive 校验 SAP HANA 归档 tar 中是否包含 databackup/logbackup 标志文件。
-func VerifySAPHANAArchive(artifactPath string) (*VerifyReport, error) {
-	file, err := os.Open(artifactPath)
-	if err != nil {
-		return nil, fmt.Errorf("open hana archive: %w", err)
-	}
-	defer file.Close()
-	tr := tar.NewReader(file)
-	report := &VerifyReport{}
-	var foundDataBackup bool
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			break
-		}
-		if err != nil {
-			return report, fmt.Errorf("read tar entry: %w", err)
-		}
-		report.TotalEntries++
-		name := strings.ToLower(header.Name)
-		if strings.Contains(name, "databackup") || strings.Contains(name, "logbackup") || strings.HasPrefix(name, "hana_") {
-			foundDataBackup = true
-		}
-		if header.Typeflag == tar.TypeReg || header.Typeflag == tar.TypeRegA {
-			n, copyErr := io.Copy(io.Discard, tr)
-			if copyErr != nil {
-				return report, fmt.Errorf("read entry %s: %w", header.Name, copyErr)
-			}
-			report.FileBytes += n
-		}
-	}
-	if !foundDataBackup {
-		return report, fmt.Errorf("HANA archive missing databackup/logbackup markers")
-	}
-	report.Detail = fmt.Sprintf("HANA 归档包含 %d 条目（%d 字节），已识别备份标志文件", report.TotalEntries, report.FileBytes)
-	return report, nil
-}
--- a/server/internal/backup/verify_test.go
+++ b/server/internal/backup/verify_test.go
@@ -1,121 +0,0 @@
-package backup
-
-import (
-	"archive/tar"
-	"bytes"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// 构造一个最小的 tar 归档文件供测试使用
-func writeTestTar(t *testing.T, entries map[string][]byte) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "test.tar")
-	buf := new(bytes.Buffer)
-	tw := tar.NewWriter(buf)
-	for name, body := range entries {
-		header := &tar.Header{Name: name, Mode: 0o644, Size: int64(len(body)), Typeflag: tar.TypeReg}
-		if err := tw.WriteHeader(header); err != nil {
-			t.Fatalf("write tar header: %v", err)
-		}
-		if _, err := tw.Write(body); err != nil {
-			t.Fatalf("write tar body: %v", err)
-		}
-	}
-	_ = tw.Close()
-	if err := os.WriteFile(path, buf.Bytes(), 0o644); err != nil {
-		t.Fatalf("write tar file: %v", err)
-	}
-	return path
-}
-
-func TestVerifyTarArchive_Valid(t *testing.T) {
-	path := writeTestTar(t, map[string][]byte{
-		"readme.md":  []byte("hello"),
-		"data.bin":   []byte("world!!!"),
-	})
-	report, err := VerifyTarArchive(path, "")
-	if err != nil {
-		t.Fatalf("VerifyTarArchive returned error: %v", err)
-	}
-	if report.TotalEntries != 2 {
-		t.Fatalf("expected 2 entries, got %d", report.TotalEntries)
-	}
-	if report.FileBytes == 0 {
-		t.Fatalf("expected non-zero file bytes")
-	}
-	if !report.ChecksumOK {
-		t.Fatalf("checksumOK should be true when expected checksum empty")
-	}
-}
-
-func TestVerifyTarArchive_Truncated(t *testing.T) {
-	// 构造带多个大 entry 的 tar，在 entry 数据中间截断，使 io.Copy 触发 UnexpectedEOF
-	path := filepath.Join(t.TempDir(), "big.tar")
-	buf := new(bytes.Buffer)
-	tw := tar.NewWriter(buf)
-	body := bytes.Repeat([]byte("x"), 4096)
-	_ = tw.WriteHeader(&tar.Header{Name: "big.bin", Mode: 0o644, Size: int64(len(body)), Typeflag: tar.TypeReg})
-	_, _ = tw.Write(body)
-	_ = tw.Close()
-	data := buf.Bytes()
-	// 保留 header 完整（512），破坏 body 中间使 tar.Reader 在 io.Copy 时遇到 EOF
-	truncated := data[:512+1024]
-	if err := os.WriteFile(path, truncated, 0o644); err != nil {
-		t.Fatalf("write truncated: %v", err)
-	}
-	if _, err := VerifyTarArchive(path, ""); err == nil {
-		t.Fatalf("expected error on truncated tar, got nil")
-	}
-}
-
-func TestVerifySQLiteFile_Valid(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "ok.db")
-	content := []byte("SQLite format 3\x00" + string(make([]byte, 100)))
-	if err := os.WriteFile(path, content, 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	report, err := VerifySQLiteFile(path)
-	if err != nil {
-		t.Fatalf("VerifySQLiteFile: %v", err)
-	}
-	if report.FileBytes == 0 {
-		t.Fatalf("expected non-zero size")
-	}
-}
-
-func TestVerifySQLiteFile_Invalid(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "bad.db")
-	if err := os.WriteFile(path, []byte("not sqlite at all, some other text"), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	if _, err := VerifySQLiteFile(path); err == nil {
-		t.Fatalf("expected error on non-sqlite file")
-	}
-}
-
-func TestVerifyMySQLDump(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "dump.sql")
-	content := "-- MySQL dump 10.13  Distrib 8.0.33\n-- Host: localhost\nINSERT INTO foo VALUES (1);\n"
-	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	report, err := VerifyMySQLDump(path)
-	if err != nil {
-		t.Fatalf("VerifyMySQLDump: %v", err)
-	}
-	if report.Detail == "" {
-		t.Fatalf("expected Detail in report")
-	}
-}
-
-func TestVerifyPostgreSQLDump_Invalid(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "notpg.sql")
-	if err := os.WriteFile(path, []byte("some random text without header markers"), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	if _, err := VerifyPostgreSQLDump(path); err == nil {
-		t.Fatalf("expected error on non-pg dump")
-	}
-}
--- a/server/internal/backup/window.go
+++ b/server/internal/backup/window.go
@@ -1,180 +0,0 @@
-package backup
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// MaintenanceWindow 描述一个允许执行备份的时段。
-// 格式语义：
-//   - Days 为 "0..6" 的字符串集合（0=周日，6=周六）；空 = 每天
-//   - StartMinutes / EndMinutes 为"午夜起计算的分钟数"，0 ≤ v < 1440
-//   - 跨午夜窗口：Start > End 表示跨夜（如 22:00-06:00）
-//
-// 多个窗口是 OR 语义：只要 now 落入任一窗口即允许执行。
-type MaintenanceWindow struct {
-	Days         map[int]bool
-	StartMinutes int
-	EndMinutes   int
-}
-
-// ParseMaintenanceWindows 解析用户配置（CSV 每项形如 "days=mon,tue|time=22:00-06:00"）。
-// 简化语法：多个窗口以 ';' 分隔，每个窗口按 "[days=xxx;]time=HH:MM-HH:MM" 格式。
-// Days 缺省 = 全周；若不合法，跳过该段而非抛错（让调用方尽力工作）。
-// 示例：
-//   "time=01:00-05:00"                        每天 1 点到 5 点
-//   "days=sat,sun;time=00:00-23:59"           仅周末全天
-//   "time=22:00-06:00"                        每天跨夜
-//   "days=mon,tue,wed,thu,fri;time=22:00-06:00" 工作日跨夜
-func ParseMaintenanceWindows(value string) []MaintenanceWindow {
-	v := strings.TrimSpace(value)
-	if v == "" {
-		return nil
-	}
-	segments := strings.Split(v, ";")
-	var windows []MaintenanceWindow
-	for _, segment := range segments {
-		segment = strings.TrimSpace(segment)
-		if segment == "" {
-			continue
-		}
-		window, ok := parseSingleWindow(segment)
-		if !ok {
-			continue
-		}
-		windows = append(windows, window)
-	}
-	return windows
-}
-
-func parseSingleWindow(segment string) (MaintenanceWindow, bool) {
-	// "days=xxx,time=HH:MM-HH:MM" 或 "time=..."
-	fields := strings.Split(segment, ",")
-	days := map[int]bool{}
-	var timeExpr string
-	for _, field := range fields {
-		field = strings.TrimSpace(field)
-		if field == "" {
-			continue
-		}
-		if strings.HasPrefix(field, "days=") {
-			daysPart := strings.TrimPrefix(field, "days=")
-			for _, day := range strings.Split(daysPart, "|") {
-				if idx := parseDayToken(strings.TrimSpace(day)); idx >= 0 {
-					days[idx] = true
-				}
-			}
-		} else if strings.HasPrefix(field, "time=") {
-			timeExpr = strings.TrimPrefix(field, "time=")
-		}
-	}
-	start, end, ok := parseTimeRange(strings.TrimSpace(timeExpr))
-	if !ok {
-		return MaintenanceWindow{}, false
-	}
-	return MaintenanceWindow{Days: days, StartMinutes: start, EndMinutes: end}, true
-}
-
-var dayTokens = map[string]int{
-	"sun": 0, "sunday": 0, "0": 0,
-	"mon": 1, "monday": 1, "1": 1,
-	"tue": 2, "tuesday": 2, "2": 2,
-	"wed": 3, "wednesday": 3, "3": 3,
-	"thu": 4, "thursday": 4, "4": 4,
-	"fri": 5, "friday": 5, "5": 5,
-	"sat": 6, "saturday": 6, "6": 6,
-}
-
-func parseDayToken(value string) int {
-	v := strings.ToLower(strings.TrimSpace(value))
-	if v == "" {
-		return -1
-	}
-	if idx, ok := dayTokens[v]; ok {
-		return idx
-	}
-	return -1
-}
-
-// parseTimeRange 解析 "HH:MM-HH:MM"，返回起止分钟数。
-func parseTimeRange(value string) (int, int, bool) {
-	parts := strings.SplitN(value, "-", 2)
-	if len(parts) != 2 {
-		return 0, 0, false
-	}
-	start, ok := parseHHMM(parts[0])
-	if !ok {
-		return 0, 0, false
-	}
-	end, ok := parseHHMM(parts[1])
-	if !ok {
-		return 0, 0, false
-	}
-	return start, end, true
-}
-
-func parseHHMM(value string) (int, bool) {
-	parts := strings.Split(strings.TrimSpace(value), ":")
-	if len(parts) != 2 {
-		return 0, false
-	}
-	h, err := strconv.Atoi(strings.TrimSpace(parts[0]))
-	if err != nil || h < 0 || h > 23 {
-		return 0, false
-	}
-	m, err := strconv.Atoi(strings.TrimSpace(parts[1]))
-	if err != nil || m < 0 || m > 59 {
-		return 0, false
-	}
-	return h*60 + m, true
-}
-
-// IsWithinWindow 判断 t 是否落入任一窗口。windows 为空或 nil 时总是返回 true（不限制）。
-func IsWithinWindow(t time.Time, windows []MaintenanceWindow) bool {
-	if len(windows) == 0 {
-		return true
-	}
-	minutes := t.Hour()*60 + t.Minute()
-	weekday := int(t.Weekday())
-	for _, w := range windows {
-		if len(w.Days) > 0 && !w.Days[weekday] {
-			continue
-		}
-		if w.StartMinutes == w.EndMinutes {
-			continue
-		}
-		if w.StartMinutes < w.EndMinutes {
-			// 同日窗口
-			if minutes >= w.StartMinutes && minutes < w.EndMinutes {
-				return true
-			}
-		} else {
-			// 跨午夜：[start, 1440) ∪ [0, end)
-			if minutes >= w.StartMinutes || minutes < w.EndMinutes {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// ValidateMaintenanceWindows 用户输入合法性校验（返回人可读的错误）。
-func ValidateMaintenanceWindows(value string) error {
-	v := strings.TrimSpace(value)
-	if v == "" {
-		return nil
-	}
-	segments := strings.Split(v, ";")
-	for _, segment := range segments {
-		segment = strings.TrimSpace(segment)
-		if segment == "" {
-			continue
-		}
-		if _, ok := parseSingleWindow(segment); !ok {
-			return fmt.Errorf("无效的维护窗口配置: %q（期望格式如 time=22:00-06:00 或 days=sat,sun,time=00:00-23:59）", segment)
-		}
-	}
-	return nil
-}
--- a/server/internal/backup/window_test.go
+++ b/server/internal/backup/window_test.go
@@ -1,110 +0,0 @@
-package backup
-
-import (
-	"testing"
-	"time"
-)
-
-func TestParseAndCheck_SingleSameDayWindow(t *testing.T) {
-	windows := ParseMaintenanceWindows("time=01:00-05:00")
-	if len(windows) != 1 {
-		t.Fatalf("expected 1 window, got %d", len(windows))
-	}
-	// 周一 03:00 UTC（天数不限制）
-	at := time.Date(2026, 4, 20, 3, 0, 0, 0, time.UTC)
-	if !IsWithinWindow(at, windows) {
-		t.Fatalf("expected 03:00 to be inside 01:00-05:00")
-	}
-	at = time.Date(2026, 4, 20, 6, 0, 0, 0, time.UTC)
-	if IsWithinWindow(at, windows) {
-		t.Fatalf("expected 06:00 to be outside 01:00-05:00")
-	}
-}
-
-func TestParseAndCheck_CrossMidnight(t *testing.T) {
-	windows := ParseMaintenanceWindows("time=22:00-06:00")
-	if len(windows) != 1 {
-		t.Fatalf("expected 1 window")
-	}
-	tests := []struct {
-		hour, minute int
-		inside       bool
-	}{
-		{22, 30, true},
-		{23, 59, true},
-		{0, 0, true},
-		{3, 0, true},
-		{5, 59, true},
-		{6, 0, false},
-		{7, 0, false},
-		{21, 59, false},
-	}
-	base := time.Date(2026, 4, 20, 0, 0, 0, 0, time.UTC)
-	for _, tc := range tests {
-		at := base.Add(time.Duration(tc.hour)*time.Hour + time.Duration(tc.minute)*time.Minute)
-		if got := IsWithinWindow(at, windows); got != tc.inside {
-			t.Errorf("%02d:%02d expected inside=%v, got %v", tc.hour, tc.minute, tc.inside, got)
-		}
-	}
-}
-
-func TestParseAndCheck_DaysFilter(t *testing.T) {
-	// 周末全天
-	windows := ParseMaintenanceWindows("days=sat|sun,time=00:00-23:59")
-	if len(windows) != 1 {
-		t.Fatalf("expected 1 window")
-	}
-	sat := time.Date(2026, 4, 18, 12, 0, 0, 0, time.UTC) // Saturday
-	sun := time.Date(2026, 4, 19, 12, 0, 0, 0, time.UTC) // Sunday
-	mon := time.Date(2026, 4, 20, 12, 0, 0, 0, time.UTC) // Monday
-	if !IsWithinWindow(sat, windows) {
-		t.Fatalf("saturday should be inside")
-	}
-	if !IsWithinWindow(sun, windows) {
-		t.Fatalf("sunday should be inside")
-	}
-	if IsWithinWindow(mon, windows) {
-		t.Fatalf("monday should be outside")
-	}
-}
-
-func TestParseAndCheck_Multiple(t *testing.T) {
-	// 两段：工作日跨夜 + 周末全天
-	windows := ParseMaintenanceWindows("days=mon|tue|wed|thu|fri,time=22:00-06:00;days=sat|sun,time=00:00-23:59")
-	if len(windows) != 2 {
-		t.Fatalf("expected 2 windows, got %d", len(windows))
-	}
-	monAfternoon := time.Date(2026, 4, 20, 15, 0, 0, 0, time.UTC)
-	if IsWithinWindow(monAfternoon, windows) {
-		t.Fatalf("mon 15:00 should be outside both windows")
-	}
-	monNight := time.Date(2026, 4, 20, 23, 0, 0, 0, time.UTC)
-	if !IsWithinWindow(monNight, windows) {
-		t.Fatalf("mon 23:00 should be inside weekday-night window")
-	}
-	sunNoon := time.Date(2026, 4, 19, 12, 0, 0, 0, time.UTC)
-	if !IsWithinWindow(sunNoon, windows) {
-		t.Fatalf("sun 12:00 should be inside weekend window")
-	}
-}
-
-func TestValidateMaintenanceWindows(t *testing.T) {
-	if err := ValidateMaintenanceWindows(""); err != nil {
-		t.Fatalf("empty should be valid, got %v", err)
-	}
-	if err := ValidateMaintenanceWindows("time=01:00-05:00"); err != nil {
-		t.Fatalf("valid format rejected: %v", err)
-	}
-	if err := ValidateMaintenanceWindows("bad-input"); err == nil {
-		t.Fatalf("invalid format should return error")
-	}
-	if err := ValidateMaintenanceWindows("time=25:00-30:00"); err == nil {
-		t.Fatalf("invalid hour should return error")
-	}
-}
-
-func TestIsWithinWindow_NoWindows(t *testing.T) {
-	if !IsWithinWindow(time.Now(), nil) {
-		t.Fatalf("no windows should always be inside")
-	}
-}
--- a/server/internal/config/config.go
+++ b/server/internal/config/config.go
@@ -17,14 +17,9 @@ type Config struct {
 }

 type ServerConfig struct {
-	Host        string `mapstructure:"host"`
-	Port        int    `mapstructure:"port"`
-	Mode        string `mapstructure:"mode"`
-	ExternalURL string `mapstructure:"external_url"`
-	// WebRoot 指向前端构建产物目录。留空时后端会按部署惯例自动探测
-	// （./web、./web/dist、/opt/backupx/web 等）。探测命中后后端直接托管
-	// 前端 SPA，无需额外的 nginx 反向代理即可访问 Web 控制台。
-	WebRoot string `mapstructure:"web_root"`
+	Host string `mapstructure:"host"`
+	Port int    `mapstructure:"port"`
+	Mode string `mapstructure:"mode"`
 }

 type DatabaseConfig struct {
@@ -141,8 +136,6 @@ func applyDefaults(v *viper.Viper) {
 	v.SetDefault("server.host", "0.0.0.0")
 	v.SetDefault("server.port", 8340)
 	v.SetDefault("server.mode", "release")
-	v.SetDefault("server.external_url", "")
-	v.SetDefault("server.web_root", "")
 	v.SetDefault("database.path", "./data/backupx.db")
 	v.SetDefault("security.jwt_expire", "24h")
 	v.SetDefault("backup.temp_dir", "/tmp/backupx")
--- a/server/internal/config/config_test.go
+++ b/server/internal/config/config_test.go
@@ -1,10 +1,6 @@
 package config

-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
+import "testing"

 func TestLoadUsesDefaultsWithoutConfigFile(t *testing.T) {
 	cfg, err := Load("")
@@ -22,33 +18,3 @@ func TestLoadUsesDefaultsWithoutConfigFile(t *testing.T) {
 		t.Fatalf("expected default database path, got %s", cfg.Database.Path)
 	}
 }
-
-func TestLoadReadsServerExternalURLFromFile(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "config.yaml")
-	content := []byte("server:\n  external_url: \"https://backup.example.com\"\n")
-	if err := os.WriteFile(configPath, content, 0o600); err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	cfg, err := Load(configPath)
-	if err != nil {
-		t.Fatalf("Load returned error: %v", err)
-	}
-
-	if cfg.Server.ExternalURL != "https://backup.example.com" {
-		t.Fatalf("expected external URL from config, got %q", cfg.Server.ExternalURL)
-	}
-}
-
-func TestLoadReadsServerExternalURLFromEnv(t *testing.T) {
-	t.Setenv("BACKUPX_SERVER_EXTERNAL_URL", "https://env-backup.example.com")
-
-	cfg, err := Load("")
-	if err != nil {
-		t.Fatalf("Load returned error: %v", err)
-	}
-
-	if cfg.Server.ExternalURL != "https://env-backup.example.com" {
-		t.Fatalf("expected external URL from env, got %q", cfg.Server.ExternalURL)
-	}
-}
--- a/server/internal/database/database.go
+++ b/server/internal/database/database.go
@@ -23,7 +23,7 @@ func Open(cfg config.DatabaseConfig, logger *zap.Logger) (*gorm.DB, error) {
 		return nil, fmt.Errorf("open sqlite: %w", err)
 	}

-	if err := db.AutoMigrate(&model.User{}, &model.SystemConfig{}, &model.StorageTarget{}, &model.OAuthSession{}, &model.BackupTask{}, &model.BackupRecord{}, &model.Notification{}, &model.Node{}, &model.BackupTaskStorageTarget{}, &model.AuditLog{}, &model.AgentCommand{}, &model.AgentInstallToken{}, &model.RestoreRecord{}, &model.VerificationRecord{}, &model.ApiKey{}, &model.ReplicationRecord{}, &model.TaskTemplate{}); err != nil {
+	if err := db.AutoMigrate(&model.User{}, &model.SystemConfig{}, &model.StorageTarget{}, &model.OAuthSession{}, &model.BackupTask{}, &model.BackupRecord{}, &model.Notification{}, &model.Node{}, &model.BackupTaskStorageTarget{}, &model.AuditLog{}, &model.AgentCommand{}, &model.AgentInstallToken{}); err != nil {
 		return nil, fmt.Errorf("migrate schema: %w", err)
 	}

--- a/server/internal/http/agent_handler.go
+++ b/server/internal/http/agent_handler.go
@@ -14,13 +14,12 @@ import (
 // AgentHandler 实现 Agent 调用 Master 的 HTTP API。
 // 全部端点通过 X-Agent-Token 头做节点认证，不使用 JWT。
 type AgentHandler struct {
-	agentService   *service.AgentService
-	nodeService    *service.NodeService
-	restoreService *service.RestoreService
+	agentService *service.AgentService
+	nodeService  *service.NodeService
 }

-func NewAgentHandler(agentService *service.AgentService, nodeService *service.NodeService, restoreService *service.RestoreService) *AgentHandler {
-	return &AgentHandler{agentService: agentService, nodeService: nodeService, restoreService: restoreService}
+func NewAgentHandler(agentService *service.AgentService, nodeService *service.NodeService) *AgentHandler {
+	return &AgentHandler{agentService: agentService, nodeService: nodeService}
 }

 // extractToken 从请求头或 JSON body 中提取 Agent Token。
@@ -156,58 +155,6 @@ func (h *AgentHandler) UpdateRecord(c *gin.Context) {
 	response.Success(c, gin.H{"status": "ok"})
 }

-// GetRestoreSpec Agent 拉取恢复规格。
-func (h *AgentHandler) GetRestoreSpec(c *gin.Context) {
-	if h.restoreService == nil {
-		c.JSON(stdhttp.StatusServiceUnavailable, gin.H{"code": "RESTORE_SERVICE_DISABLED", "message": "restore service is not enabled"})
-		return
-	}
-	node, err := h.agentService.AuthenticatedNode(c.Request.Context(), extractToken(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	spec, err := h.restoreService.GetAgentRestoreSpec(c.Request.Context(), node, uint(id))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, spec)
-}
-
-// UpdateRestore Agent 上报恢复记录的状态/日志。
-func (h *AgentHandler) UpdateRestore(c *gin.Context) {
-	if h.restoreService == nil {
-		c.JSON(stdhttp.StatusServiceUnavailable, gin.H{"code": "RESTORE_SERVICE_DISABLED", "message": "restore service is not enabled"})
-		return
-	}
-	node, err := h.agentService.AuthenticatedNode(c.Request.Context(), extractToken(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	var input service.AgentRestoreUpdate
-	if err := c.ShouldBindJSON(&input); err != nil {
-		c.JSON(stdhttp.StatusBadRequest, gin.H{"code": "INVALID_INPUT", "message": err.Error()})
-		return
-	}
-	if err := h.restoreService.UpdateAgentRestore(c.Request.Context(), node, uint(id), input); err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, gin.H{"status": "ok"})
-}
-
 // Self 返回当前 Agent token 所属节点的状态，供安装脚本末尾探活。
 func (h *AgentHandler) Self(c *gin.Context) {
 	node, err := h.agentService.AuthenticatedNode(c.Request.Context(), extractToken(c))
--- a/server/internal/http/api_key_handler.go
+++ b/server/internal/http/api_key_handler.go
@@ -1,93 +0,0 @@
-package http
-
-import (
-	"fmt"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// ApiKeyHandler 管理 API Key（admin 专属）。
-type ApiKeyHandler struct {
-	service      *service.ApiKeyService
-	auditService *service.AuditService
-}
-
-func NewApiKeyHandler(apiKeyService *service.ApiKeyService, auditService *service.AuditService) *ApiKeyHandler {
-	return &ApiKeyHandler{service: apiKeyService, auditService: auditService}
-}
-
-func (h *ApiKeyHandler) List(c *gin.Context) {
-	items, err := h.service.List(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *ApiKeyHandler) Create(c *gin.Context) {
-	var input service.ApiKeyCreateInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("API_KEY_INVALID", "API Key 参数不合法", err))
-		return
-	}
-	creator := ""
-	if username, exists := c.Get(contextUsernameKey); exists {
-		if v, ok := username.(string); ok {
-			creator = v
-		}
-	}
-	result, err := h.service.Create(c.Request.Context(), creator, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "api_key", "create", "api_key", fmt.Sprintf("%d", result.ApiKey.ID), result.ApiKey.Name,
-		fmt.Sprintf("创建 API Key: %s (角色: %s)", result.ApiKey.Name, result.ApiKey.Role))
-	response.Success(c, result)
-}
-
-func (h *ApiKeyHandler) Revoke(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	if err := h.service.Revoke(c.Request.Context(), id); err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "api_key", "revoke", "api_key", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("撤销 API Key (ID: %d)", id))
-	response.Success(c, gin.H{"revoked": true})
-}
-
-func (h *ApiKeyHandler) Toggle(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input struct {
-		Disabled bool `json:"disabled"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("API_KEY_INVALID", "参数不合法", err))
-		return
-	}
-	if err := h.service.ToggleDisabled(c.Request.Context(), id, input.Disabled); err != nil {
-		response.Error(c, err)
-		return
-	}
-	action := "enable"
-	label := "启用"
-	if input.Disabled {
-		action = "disable"
-		label = "停用"
-	}
-	recordAudit(c, h.auditService, "api_key", action, "api_key", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("%s API Key (ID: %d)", label, id))
-	response.Success(c, gin.H{"disabled": input.Disabled})
-}
--- a/server/internal/http/audit_handler.go
+++ b/server/internal/http/audit_handler.go
@@ -1,18 +1,11 @@
 package http

 import (
-	"encoding/csv"
-	"fmt"
-	stdhttp "net/http"
 	"strconv"
 	"strings"
-	"time"

-	"backupx/server/internal/apperror"
-	"backupx/server/internal/repository"
 	"backupx/server/internal/service"
 	"backupx/server/pkg/response"
-
 	"github.com/gin-gonic/gin"
 )

@@ -24,97 +17,24 @@ func NewAuditHandler(auditService *service.AuditService) *AuditHandler {
 	return &AuditHandler{auditService: auditService}
 }

-// List 多字段筛选分页查询审计日志。
-// 支持参数：category, action, username, targetId, keyword, dateFrom, dateTo, limit, offset。
-// 向后兼容：若仅传 category + limit + offset，行为与旧版一致。
 func (h *AuditHandler) List(c *gin.Context) {
-	opts, err := parseAuditFilter(c)
-	if err != nil {
-		response.Error(c, err)
-		return
+	category := strings.TrimSpace(c.Query("category"))
+	limit := 50
+	offset := 0
+	if v := strings.TrimSpace(c.Query("limit")); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 {
+			limit = parsed
+		}
 	}
-	result, err := h.auditService.ListAdvanced(c.Request.Context(), opts)
+	if v := strings.TrimSpace(c.Query("offset")); v != "" {
+		if parsed, err := strconv.Atoi(v); err == nil && parsed >= 0 {
+			offset = parsed
+		}
+	}
+	result, err := h.auditService.List(c.Request.Context(), category, limit, offset)
 	if err != nil {
 		response.Error(c, err)
 		return
 	}
 	response.Success(c, result)
 }
-
-// Export 导出 CSV。同筛选参数，最多 10000 行。
-// 文件名带时间戳避免浏览器缓存覆盖。
-func (h *AuditHandler) Export(c *gin.Context) {
-	opts, err := parseAuditFilter(c)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	// 导出不分页：覆盖掉 List 的默认 limit
-	opts.Limit = 0
-	opts.Offset = 0
-	items, err := h.auditService.ExportAll(c.Request.Context(), opts)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	filename := fmt.Sprintf("backupx-audit-%s.csv", time.Now().UTC().Format("20060102-150405"))
-	c.Header("Content-Type", "text/csv; charset=utf-8")
-	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
-	// UTF-8 BOM 让 Excel 正确识别中文
-	_, _ = c.Writer.Write([]byte{0xEF, 0xBB, 0xBF})
-	writer := csv.NewWriter(c.Writer)
-	_ = writer.Write([]string{"时间", "用户", "类别", "动作", "目标类型", "目标 ID", "目标名", "详情", "客户端 IP"})
-	for _, item := range items {
-		_ = writer.Write([]string{
-			item.CreatedAt.UTC().Format(time.RFC3339),
-			item.Username,
-			item.Category,
-			item.Action,
-			item.TargetType,
-			item.TargetID,
-			item.TargetName,
-			item.Detail,
-			item.ClientIP,
-		})
-	}
-	writer.Flush()
-	if err := writer.Error(); err != nil {
-		c.Writer.WriteHeader(stdhttp.StatusInternalServerError)
-	}
-}
-
-// parseAuditFilter 解析查询参数为 repository 选项。
-func parseAuditFilter(c *gin.Context) (repository.AuditLogListOptions, error) {
-	opts := repository.AuditLogListOptions{
-		Category: strings.TrimSpace(c.Query("category")),
-		Action:   strings.TrimSpace(c.Query("action")),
-		Username: strings.TrimSpace(c.Query("username")),
-		TargetID: strings.TrimSpace(c.Query("targetId")),
-		Keyword:  strings.TrimSpace(c.Query("keyword")),
-	}
-	if v := strings.TrimSpace(c.Query("limit")); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			opts.Limit = n
-		}
-	}
-	if v := strings.TrimSpace(c.Query("offset")); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
-			opts.Offset = n
-		}
-	}
-	if v := strings.TrimSpace(c.Query("dateFrom")); v != "" {
-		parsed, err := time.Parse(time.RFC3339, v)
-		if err != nil {
-			return opts, apperror.BadRequest("AUDIT_FILTER_INVALID", "dateFrom 必须为 RFC3339 时间格式", err)
-		}
-		opts.DateFrom = &parsed
-	}
-	if v := strings.TrimSpace(c.Query("dateTo")); v != "" {
-		parsed, err := time.Parse(time.RFC3339, v)
-		if err != nil {
-			return opts, apperror.BadRequest("AUDIT_FILTER_INVALID", "dateTo 必须为 RFC3339 时间格式", err)
-		}
-		opts.DateTo = &parsed
-	}
-	return opts, nil
-}
--- a/server/internal/http/auth_handler.go
+++ b/server/internal/http/auth_handler.go
@@ -1,23 +1,12 @@
 package http

 import (
-	"net"
-	stdhttp "net/http"
-	"strings"
-	"time"
-
 	"backupx/server/internal/apperror"
 	"backupx/server/internal/service"
 	"backupx/server/pkg/response"
 	"github.com/gin-gonic/gin"
 )

-const (
-	trustedDeviceCookieName   = "backupx_trusted_device"
-	trustedDeviceCookiePath   = "/api/auth"
-	trustedDeviceCookieMaxAge = int((30 * 24 * time.Hour) / time.Second)
-)
-
 type AuthHandler struct {
 	authService *service.AuthService
 }
@@ -55,18 +44,11 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		response.Error(c, apperror.BadRequest("AUTH_LOGIN_INVALID", "登录参数不合法", err))
 		return
 	}
-	if strings.TrimSpace(input.TrustedDeviceToken) == "" {
-		input.TrustedDeviceToken = trustedDeviceCookieValue(c)
-	}
 	payload, err := h.authService.Login(c.Request.Context(), input, ClientKey(c))
 	if err != nil {
 		response.Error(c, err)
 		return
 	}
-	if payload.TrustedDeviceToken != "" {
-		setTrustedDeviceCookie(c, payload.TrustedDeviceToken)
-		payload.TrustedDeviceToken = ""
-	}
 	response.Success(c, payload)
 }

@@ -101,315 +83,9 @@ func (h *AuthHandler) ChangePassword(c *gin.Context) {
 		response.Error(c, err)
 		return
 	}
-	clearTrustedDeviceCookie(c)
 	response.Success(c, gin.H{"changed": true})
 }

-func (h *AuthHandler) PrepareTwoFactor(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.TwoFactorSetupInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_2FA_INVALID", "参数不合法", err))
-		return
-	}
-	payload, err := h.authService.PrepareTwoFactor(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-func (h *AuthHandler) EnableTwoFactor(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.EnableTwoFactorInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_2FA_INVALID", "参数不合法", err))
-		return
-	}
-	user, err := h.authService.EnableTwoFactor(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, user)
-}
-
-func (h *AuthHandler) DisableTwoFactor(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.DisableTwoFactorInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_2FA_INVALID", "参数不合法", err))
-		return
-	}
-	user, err := h.authService.DisableTwoFactor(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	if !user.MFAEnabled {
-		clearTrustedDeviceCookie(c)
-	}
-	response.Success(c, user)
-}
-
-func (h *AuthHandler) RegenerateRecoveryCodes(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.RegenerateRecoveryCodesInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_2FA_INVALID", "参数不合法", err))
-		return
-	}
-	payload, err := h.authService.RegenerateRecoveryCodes(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-func (h *AuthHandler) ConfigureOTP(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.OTPConfigInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_OTP_INVALID", "参数不合法", err))
-		return
-	}
-	user, err := h.authService.ConfigureOutOfBandOTP(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	if !user.MFAEnabled {
-		clearTrustedDeviceCookie(c)
-	}
-	response.Success(c, user)
-}
-
-func (h *AuthHandler) SendLoginOTP(c *gin.Context) {
-	var input service.LoginOTPInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_OTP_INVALID", "参数不合法", err))
-		return
-	}
-	if err := h.authService.SendLoginOTP(c.Request.Context(), input, ClientKey(c)); err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, gin.H{"sent": true})
-}
-
-func (h *AuthHandler) BeginWebAuthnRegistration(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.WebAuthnRegistrationOptionsInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_WEBAUTHN_INVALID", "参数不合法", err))
-		return
-	}
-	options, err := h.authService.BeginWebAuthnRegistration(c.Request.Context(), subject, input, webAuthnRequestContext(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, options)
-}
-
-func (h *AuthHandler) FinishWebAuthnRegistration(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.WebAuthnRegistrationFinishInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_WEBAUTHN_INVALID", "参数不合法", err))
-		return
-	}
-	user, err := h.authService.FinishWebAuthnRegistration(c.Request.Context(), subject, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, user)
-}
-
-func (h *AuthHandler) BeginWebAuthnLogin(c *gin.Context) {
-	var input service.WebAuthnLoginOptionsInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_WEBAUTHN_INVALID", "参数不合法", err))
-		return
-	}
-	options, err := h.authService.BeginWebAuthnLogin(c.Request.Context(), input, webAuthnRequestContext(c), ClientKey(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, options)
-}
-
-func (h *AuthHandler) ListWebAuthnCredentials(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	items, err := h.authService.ListWebAuthnCredentials(c.Request.Context(), subject)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *AuthHandler) DeleteWebAuthnCredential(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.WebAuthnCredentialDeleteInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_WEBAUTHN_INVALID", "参数不合法", err))
-		return
-	}
-	user, err := h.authService.DeleteWebAuthnCredential(c.Request.Context(), subject, c.Param("id"), input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	if !user.MFAEnabled {
-		clearTrustedDeviceCookie(c)
-	}
-	response.Success(c, user)
-}
-
-func (h *AuthHandler) ListTrustedDevices(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	items, err := h.authService.ListTrustedDevices(c.Request.Context(), subject)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *AuthHandler) RevokeTrustedDevice(c *gin.Context) {
-	subjectValue, _ := c.Get(contextUserSubjectKey)
-	subject, err := service.SubjectFromContextValue(subjectValue)
-	if err != nil {
-		response.Error(c, apperror.Unauthorized("AUTH_INVALID_SUBJECT", "无效登录态", err))
-		return
-	}
-	var input service.TrustedDeviceRevokeInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("AUTH_TRUSTED_DEVICE_INVALID", "参数不合法", err))
-		return
-	}
-	if err := h.authService.RevokeTrustedDevice(c.Request.Context(), subject, c.Param("id"), input); err != nil {
-		response.Error(c, err)
-		return
-	}
-	clearTrustedDeviceCookie(c)
-	response.Success(c, gin.H{"deleted": true})
-}
-
 func (h *AuthHandler) Logout(c *gin.Context) {
 	response.Success(c, gin.H{"loggedOut": true})
 }
-
-func webAuthnRequestContext(c *gin.Context) service.WebAuthnRequestContext {
-	host := firstForwardedValue(c.Request.Host)
-	if forwardedHost := firstForwardedValue(c.GetHeader("X-Forwarded-Host")); forwardedHost != "" {
-		host = forwardedHost
-	}
-	rpID := host
-	if parsedHost, _, err := net.SplitHostPort(host); err == nil {
-		rpID = parsedHost
-	}
-	scheme := "http"
-	if c.Request.TLS != nil {
-		scheme = "https"
-	}
-	if forwardedProto := firstForwardedValue(c.GetHeader("X-Forwarded-Proto")); forwardedProto != "" {
-		scheme = forwardedProto
-	}
-	origin := strings.TrimSpace(c.GetHeader("Origin"))
-	if origin == "" {
-		origin = scheme + "://" + host
-	}
-	return service.WebAuthnRequestContext{RPID: rpID, Origin: origin}
-}
-
-func firstForwardedValue(value string) string {
-	parts := strings.Split(value, ",")
-	if len(parts) == 0 {
-		return ""
-	}
-	return strings.TrimSpace(parts[0])
-}
-
-func trustedDeviceCookieValue(c *gin.Context) string {
-	token, err := c.Cookie(trustedDeviceCookieName)
-	if err != nil {
-		return ""
-	}
-	return strings.TrimSpace(token)
-}
-
-func setTrustedDeviceCookie(c *gin.Context, token string) {
-	writeTrustedDeviceCookie(c, strings.TrimSpace(token), trustedDeviceCookieMaxAge)
-}
-
-func clearTrustedDeviceCookie(c *gin.Context) {
-	writeTrustedDeviceCookie(c, "", -1)
-}
-
-func writeTrustedDeviceCookie(c *gin.Context, value string, maxAge int) {
-	c.SetSameSite(stdhttp.SameSiteLaxMode)
-	c.SetCookie(trustedDeviceCookieName, value, maxAge, trustedDeviceCookiePath, "", requestIsSecure(c), true)
-}
-
-func requestIsSecure(c *gin.Context) bool {
-	if c.Request.TLS != nil {
-		return true
-	}
-	return strings.EqualFold(firstForwardedValue(c.GetHeader("X-Forwarded-Proto")), "https")
-}
--- a/server/internal/http/backup_record_handler.go
+++ b/server/internal/http/backup_record_handler.go
@@ -16,13 +16,12 @@ import (
 )

 type BackupRecordHandler struct {
-	service        *service.BackupRecordService
-	restoreService *service.RestoreService
-	auditService   *service.AuditService
+	service      *service.BackupRecordService
+	auditService *service.AuditService
 }

-func NewBackupRecordHandler(recordService *service.BackupRecordService, restoreService *service.RestoreService, auditService *service.AuditService) *BackupRecordHandler {
-	return &BackupRecordHandler{service: recordService, restoreService: restoreService, auditService: auditService}
+func NewBackupRecordHandler(recordService *service.BackupRecordService, auditService *service.AuditService) *BackupRecordHandler {
+	return &BackupRecordHandler{service: recordService, auditService: auditService}
 }

 func (h *BackupRecordHandler) List(c *gin.Context) {
@@ -52,20 +51,6 @@ func (h *BackupRecordHandler) Get(c *gin.Context) {
 	response.Success(c, item)
 }

-// Contents 返回备份记录的文件清单（内容浏览，只读）。
-func (h *BackupRecordHandler) Contents(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	contents, err := h.service.ListContents(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, contents)
-}
-
 func (h *BackupRecordHandler) StreamLogs(c *gin.Context) {
 	id, ok := parseUintParam(c, "id")
 	if !ok {
@@ -136,33 +121,18 @@ func (h *BackupRecordHandler) Download(c *gin.Context) {
 	_, _ = io.Copy(c.Writer, result.Reader)
 }

-// Restore 启动一次异步恢复并返回 restoreRecordId；实际执行路由由 RestoreService
-// 根据 task.NodeID 决定（本地 Master or 远程 Agent）。
 func (h *BackupRecordHandler) Restore(c *gin.Context) {
 	id, ok := parseUintParam(c, "id")
 	if !ok {
 		return
 	}
-	if h.restoreService == nil {
-		response.Error(c, apperror.Internal("RESTORE_SERVICE_DISABLED", "恢复服务未启用", nil))
-		return
-	}
-	triggeredBy := ""
-	if subject, exists := c.Get(contextUserSubjectKey); exists {
-		triggeredBy = strings.TrimSpace(fmt.Sprintf("%v", subject))
-	}
-	var body struct {
-		SelectedPaths []string `json:"selectedPaths"`
-	}
-	_ = c.ShouldBindJSON(&body) // body 可选：无 body 为整体恢复，含 selectedPaths 为按需恢复
-	detail, err := h.restoreService.StartSelective(c.Request.Context(), id, body.SelectedPaths, triggeredBy)
-	if err != nil {
+	if err := h.service.Restore(c.Request.Context(), id); err != nil {
 		response.Error(c, err)
 		return
 	}
 	recordAudit(c, h.auditService, "backup_record", "restore", "backup_record", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("启动恢复 (备份记录 ID: %d, 恢复记录 ID: %d)", id, detail.ID))
-	response.Success(c, detail)
+		fmt.Sprintf("恢复备份记录 (ID: %d)", id))
+	response.Success(c, gin.H{"restored": true})
 }

 func (h *BackupRecordHandler) Delete(c *gin.Context) {
@@ -179,32 +149,6 @@ func (h *BackupRecordHandler) Delete(c *gin.Context) {
 	response.Success(c, gin.H{"deleted": true})
 }

-// SetLock 设置/解除备份记录的保留锁定（法律保留）。
-func (h *BackupRecordHandler) SetLock(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input struct {
-		Locked bool `json:"locked"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("BACKUP_RECORD_LOCK_INVALID", "锁定参数不合法", err))
-		return
-	}
-	detail, err := h.service.SetLock(c.Request.Context(), id, input.Locked)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	action, desc := "unlock", fmt.Sprintf("解除备份记录保留锁定 (ID: %d)", id)
-	if input.Locked {
-		action, desc = "lock", fmt.Sprintf("设置备份记录保留锁定 (ID: %d)", id)
-	}
-	recordAudit(c, h.auditService, "backup_record", action, "backup_record", fmt.Sprintf("%d", id), "", desc)
-	response.Success(c, detail)
-}
-
 func (h *BackupRecordHandler) BatchDelete(c *gin.Context) {
 	var input struct {
 		IDs []uint `json:"ids" binding:"required,min=1"`
@@ -260,7 +204,7 @@ func writeSSEEvent(writer io.Writer, event backup.LogEvent) error {
 }

 func parseUintString(value string) (uint, bool) {
-	parsed, err := strconv.ParseUint(strings.TrimSpace(value), 10, 0)
+	parsed, err := strconv.ParseUint(strings.TrimSpace(value), 10, 64)
 	if err != nil {
 		return 0, false
 	}
--- a/server/internal/http/backup_run_handler.go
+++ b/server/internal/http/backup_run_handler.go
@@ -3,7 +3,6 @@ package http
 import (
 	"fmt"

-	"backupx/server/internal/apperror"
 	"backupx/server/internal/service"
 	"backupx/server/pkg/response"
 	"github.com/gin-gonic/gin"
@@ -31,37 +30,3 @@ func (h *BackupRunHandler) Run(c *gin.Context) {
 	recordAudit(c, h.auditService, "backup_task", "run", "backup_task", fmt.Sprintf("%d", id), "", "手动触发备份")
 	response.Success(c, record)
 }
-
-// BatchRun 批量触发备份任务。best-effort：单个失败不影响其他。
-// Body: {"ids": [1,2,3]}
-func (h *BackupRunHandler) BatchRun(c *gin.Context) {
-	var input struct {
-		IDs []uint `json:"ids" binding:"required,min=1"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("BACKUP_TASK_BATCH_INVALID", "批量执行参数不合法", err))
-		return
-	}
-	results := make([]service.BatchResult, 0, len(input.IDs))
-	succ := 0
-	for _, id := range input.IDs {
-		if id == 0 {
-			continue
-		}
-		_, err := h.service.RunTaskByID(c.Request.Context(), id)
-		item := service.BatchResult{ID: id, Success: err == nil}
-		if err != nil {
-			if appErr, ok := err.(*apperror.AppError); ok {
-				item.Error = appErr.Message
-			} else {
-				item.Error = err.Error()
-			}
-		} else {
-			succ++
-		}
-		results = append(results, item)
-	}
-	recordAudit(c, h.auditService, "backup_task", "batch_run", "backup_task", "", "",
-		fmt.Sprintf("批量触发备份 %d/%d", succ, len(results)))
-	response.Success(c, results)
-}
--- a/server/internal/http/backup_task_handler.go
+++ b/server/internal/http/backup_task_handler.go
@@ -40,16 +40,6 @@ func (h *BackupTaskHandler) List(c *gin.Context) {
 	response.Success(c, items)
 }

-// ListTags 返回系统内所有任务用过的唯一标签列表，供前端标签选择器的建议词。
-func (h *BackupTaskHandler) ListTags(c *gin.Context) {
-	tags, err := h.service.ListTags(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, tags)
-}
-
 func (h *BackupTaskHandler) Get(c *gin.Context) {
 	id, ok := parseUintParam(c, "id")
 	if !ok {
@@ -116,55 +106,6 @@ func (h *BackupTaskHandler) Delete(c *gin.Context) {
 	response.Success(c, gin.H{"deleted": true})
 }

-// BatchToggle / BatchDelete 批量操作。
-// Body: {"ids": [1,2,3], "enabled": true}  (enabled 仅 toggle 用)
-func (h *BackupTaskHandler) BatchToggle(c *gin.Context) {
-	var input struct {
-		IDs     []uint `json:"ids" binding:"required,min=1"`
-		Enabled bool   `json:"enabled"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("BACKUP_TASK_BATCH_INVALID", "批量操作参数不合法", err))
-		return
-	}
-	results := h.service.BatchToggle(c.Request.Context(), input.IDs, input.Enabled)
-	succ := 0
-	for _, r := range results {
-		if r.Success {
-			succ++
-		}
-	}
-	action := "batch_enable"
-	label := "启用"
-	if !input.Enabled {
-		action = "batch_disable"
-		label = "停用"
-	}
-	recordAudit(c, h.auditService, "backup_task", action, "backup_task", "", "",
-		fmt.Sprintf("批量%s %d/%d 个任务", label, succ, len(results)))
-	response.Success(c, results)
-}
-
-func (h *BackupTaskHandler) BatchDelete(c *gin.Context) {
-	var input struct {
-		IDs []uint `json:"ids" binding:"required,min=1"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("BACKUP_TASK_BATCH_INVALID", "批量删除参数不合法", err))
-		return
-	}
-	results := h.service.BatchDeleteTasks(c.Request.Context(), input.IDs)
-	succ := 0
-	for _, r := range results {
-		if r.Success {
-			succ++
-		}
-	}
-	recordAudit(c, h.auditService, "backup_task", "batch_delete", "backup_task", "", "",
-		fmt.Sprintf("批量删除 %d/%d 个任务", succ, len(results)))
-	response.Success(c, results)
-}
-
 func (h *BackupTaskHandler) Toggle(c *gin.Context) {
 	id, ok := parseUintParam(c, "id")
 	if !ok {
--- a/server/internal/http/context.go
+++ b/server/internal/http/context.go
@@ -1,9 +1,3 @@
 package http

-const (
-	contextUserSubjectKey = "userSubject"
-	contextUserRoleKey    = "userRole"
-	contextUsernameKey    = "username"
-	// contextAuthSubjectKey 标识认证主体来源（user | api_key），便于审计追踪。
-	contextAuthSubjectKey = "authSubject"
-)
+const contextUserSubjectKey = "userSubject"
--- a/server/internal/http/dashboard_handler.go
+++ b/server/internal/http/dashboard_handler.go
@@ -27,58 +27,6 @@ func (h *DashboardHandler) Stats(c *gin.Context) {
 	response.Success(c, payload)
 }

-// SLA 返回所有启用任务的 SLA 合规视图。用于 Dashboard 企业合规卡片。
-func (h *DashboardHandler) SLA(c *gin.Context) {
-	payload, err := h.service.SLACompliance(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-// Cluster 返回集群节点概览（在线/离线/过期 Agent 等），用于 Dashboard 卡片。
-func (h *DashboardHandler) Cluster(c *gin.Context) {
-	payload, err := h.service.ClusterOverview(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-// NodePerformance 返回各节点近 N 天的执行表现（成功率/字节数/平均耗时）。
-func (h *DashboardHandler) NodePerformance(c *gin.Context) {
-	days := 30
-	if v := strings.TrimSpace(c.Query("days")); v != "" {
-		if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 {
-			days = parsed
-		}
-	}
-	payload, err := h.service.NodePerformance(c.Request.Context(), days)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-// Breakdown 返回按类型/状态/节点/存储分组的统计。
-func (h *DashboardHandler) Breakdown(c *gin.Context) {
-	days := 30
-	if v := strings.TrimSpace(c.Query("days")); v != "" {
-		if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 {
-			days = parsed
-		}
-	}
-	payload, err := h.service.Breakdown(c.Request.Context(), days)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
 func (h *DashboardHandler) Timeline(c *gin.Context) {
 	days := 30
 	if value := strings.TrimSpace(c.Query("days")); value != "" {
--- a/server/internal/http/events_handler.go
+++ b/server/internal/http/events_handler.go
@@ -1,81 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"time"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// EventsHandler 实时事件推送（SSE）。
-// 前端通过 EventSource 订阅 /api/events/stream，实时接收系统事件，
-// 用于 Dashboard 免刷新更新 / 桌面 Toast / 实时告警。
-type EventsHandler struct {
-	broadcaster *service.EventBroadcaster
-}
-
-func NewEventsHandler(broadcaster *service.EventBroadcaster) *EventsHandler {
-	return &EventsHandler{broadcaster: broadcaster}
-}
-
-// Stream SSE 长连接。JWT/API Key 中间件之后。
-// 心跳：每 25s 发一条 comment 行（: keepalive）保持连接不被代理断开。
-func (h *EventsHandler) Stream(c *gin.Context) {
-	if h.broadcaster == nil {
-		response.Error(c, apperror.Internal("EVENTS_DISABLED", "事件广播器未启用", nil))
-		return
-	}
-	c.Writer.Header().Set("Content-Type", "text/event-stream")
-	c.Writer.Header().Set("Cache-Control", "no-cache")
-	c.Writer.Header().Set("Connection", "keep-alive")
-	c.Writer.Header().Set("X-Accel-Buffering", "no") // 禁用 nginx 缓冲
-	flusher, ok := c.Writer.(interface{ Flush() })
-	if !ok {
-		response.Error(c, apperror.Internal("EVENTS_STREAM_UNSUPPORTED", "当前连接不支持 SSE", nil))
-		return
-	}
-	// 首先发送一次 hello 让客户端确认连通
-	_, _ = fmt.Fprintf(c.Writer, ": connected %d\n\n", time.Now().Unix())
-	flusher.Flush()
-
-	ch, cancel := h.broadcaster.Subscribe(32)
-	defer cancel()
-
-	heartbeat := time.NewTicker(25 * time.Second)
-	defer heartbeat.Stop()
-
-	for {
-		select {
-		case <-c.Request.Context().Done():
-			return
-		case <-heartbeat.C:
-			if _, err := fmt.Fprintf(c.Writer, ": heartbeat %d\n\n", time.Now().Unix()); err != nil {
-				return
-			}
-			flusher.Flush()
-		case envelope, ok := <-ch:
-			if !ok {
-				return
-			}
-			if err := writeEventEnvelope(c.Writer, envelope); err != nil {
-				return
-			}
-			flusher.Flush()
-		}
-	}
-}
-
-func writeEventEnvelope(writer io.Writer, envelope service.EventEnvelope) error {
-	data, err := json.Marshal(envelope)
-	if err != nil {
-		return err
-	}
-	_, err = fmt.Fprintf(writer, "event: %s\ndata: %s\n\n", envelope.Type, data)
-	return err
-}
--- a/server/internal/http/health_handler.go
+++ b/server/internal/http/health_handler.go
@@ -1,75 +0,0 @@
-package http
-
-import (
-	stdhttp "net/http"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"gorm.io/gorm"
-)
-
-// HealthHandler 提供 K8s/Swarm 风格的健康检查端点。
-//
-// - /health ：liveness 探针。进程存活即 200（不检查任何依赖）。
-// - /ready  ：readiness 探针。检查数据库连通，不通则返回 503。
-//
-// 两者均为公开端点（无认证中间件），供外部编排系统探测。
-// 输出最少信息，避免泄露内部结构。
-type HealthHandler struct {
-	db        *gorm.DB
-	startedAt time.Time
-	version   string
-}
-
-func NewHealthHandler(db *gorm.DB, version string) *HealthHandler {
-	return &HealthHandler{db: db, startedAt: time.Now().UTC(), version: version}
-}
-
-// Live 用于 liveness：只要进程能响应就返回 200。
-func (h *HealthHandler) Live(c *gin.Context) {
-	c.JSON(stdhttp.StatusOK, gin.H{
-		"status":    "live",
-		"version":   h.version,
-		"uptime":    int(time.Since(h.startedAt).Seconds()),
-		"timestamp": time.Now().UTC().Format(time.RFC3339),
-	})
-}
-
-// Ready 用于 readiness：依赖（数据库）不可用时返回 503。
-// 新实例启动或数据库短暂失联时，编排系统据此停止转发流量。
-func (h *HealthHandler) Ready(c *gin.Context) {
-	checks := map[string]string{}
-	overallOK := true
-	if h.db != nil {
-		sqlDB, err := h.db.DB()
-		if err != nil {
-			checks["database"] = "error: " + err.Error()
-			overallOK = false
-		} else {
-			ctx, cancel := c.Request.Context(), func() {}
-			_ = cancel
-			if err := sqlDB.PingContext(ctx); err != nil {
-				checks["database"] = "ping failed: " + err.Error()
-				overallOK = false
-			} else {
-				checks["database"] = "ok"
-			}
-		}
-	} else {
-		checks["database"] = "not configured"
-		overallOK = false
-	}
-	status := stdhttp.StatusOK
-	state := "ready"
-	if !overallOK {
-		status = stdhttp.StatusServiceUnavailable
-		state = "not_ready"
-	}
-	c.JSON(status, gin.H{
-		"status":    state,
-		"version":   h.version,
-		"uptime":    int(time.Since(h.startedAt).Seconds()),
-		"checks":    checks,
-		"timestamp": time.Now().UTC().Format(time.RFC3339),
-	})
-}
--- a/server/internal/http/install_flow_test.go
+++ b/server/internal/http/install_flow_test.go
@@ -3,12 +3,10 @@ package http
 import (
 	"bytes"
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -19,20 +17,15 @@ import (
 	"backupx/server/internal/repository"
 	"backupx/server/internal/security"
 	"backupx/server/internal/service"
-	"backupx/server/internal/storage/codec"
 )

 // setupInstallFlowRouter 构造一个 Node + Agent + InstallToken 全量依赖的 router，
 // 并返回已登录管理员 JWT。
 func setupInstallFlowRouter(t *testing.T) (http.Handler, string) {
-	return setupInstallFlowRouterWithExternalURL(t, "")
-}
-
-func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (http.Handler, string) {
 	t.Helper()
 	tempDir := t.TempDir()
 	cfg := config.Config{
-		Server:   config.ServerConfig{Host: "127.0.0.1", Port: 8340, Mode: "test", ExternalURL: externalURL},
+		Server:   config.ServerConfig{Host: "127.0.0.1", Port: 8340, Mode: "test"},
 		Database: config.DatabaseConfig{Path: filepath.Join(tempDir, "backupx.db")},
 		Security: config.SecurityConfig{JWTExpire: "24h"},
 		Log:      config.LogConfig{Level: "error"},
@@ -45,13 +38,6 @@ func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (ht
 	if err != nil {
 		t.Fatalf("db: %v", err)
 	}
-	sqlDB, err := db.DB()
-	if err != nil {
-		t.Fatalf("sql db: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = sqlDB.Close()
-	})

 	userRepo := repository.NewUserRepository(db)
 	systemConfigRepo := repository.NewSystemConfigRepository(db)
@@ -60,7 +46,7 @@ func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (ht
 		t.Fatalf("security: %v", err)
 	}
 	jwtMgr := security.NewJWTManager(resolved.JWTSecret, time.Hour)
-	authSvc := service.NewAuthService(userRepo, systemConfigRepo, jwtMgr, security.NewLoginRateLimiter(5, time.Minute), codec.NewConfigCipher(resolved.EncryptionKey))
+	authSvc := service.NewAuthService(userRepo, systemConfigRepo, jwtMgr, security.NewLoginRateLimiter(5, time.Minute))
 	systemSvc := service.NewSystemService(cfg, "test", time.Now().UTC())

 	nodeRepo := repository.NewNodeRepository(db)
@@ -72,6 +58,9 @@ func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (ht
 	installTokenRepo := repository.NewAgentInstallTokenRepository(db)
 	installTokenSvc := service.NewInstallTokenService(installTokenRepo, nodeRepo)

+	auditLogRepo := repository.NewAuditLogRepository(db)
+	auditSvc := service.NewAuditService(auditLogRepo)
+
 	// 用 cancelable ctx，测试结束时停掉 handler 启动的后台 GC 协程，
 	// 避免 goroutine 持有 map 导致 tempdir 清理失败。
 	ctx, cancel := context.WithCancel(context.Background())
@@ -86,7 +75,7 @@ func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (ht
 		SystemService:       systemSvc,
 		NodeService:         nodeSvc,
 		InstallTokenService: installTokenSvc,
-		MasterExternalURL:   cfg.Server.ExternalURL,
+		AuditService:        auditSvc,
 		JWTManager:          jwtMgr,
 		UserRepository:      userRepo,
 		SystemConfigRepo:    systemConfigRepo,
@@ -115,73 +104,6 @@ func setupInstallFlowRouterWithExternalURL(t *testing.T, externalURL string) (ht
 	return router, setupResp.Data.Token
 }

-func TestInstallTokenUsesConfiguredExternalURL(t *testing.T) {
-	const externalURL = "https://public.example.com/base"
-	router, jwt := setupInstallFlowRouterWithExternalURL(t, externalURL)
-
-	batchBody, _ := json.Marshal(map[string][]string{"names": {"external-url-node"}})
-	batchReq := httptest.NewRequest(http.MethodPost, "/api/nodes/batch", bytes.NewBuffer(batchBody))
-	batchReq.Header.Set("Content-Type", "application/json")
-	batchReq.Header.Set("Authorization", "Bearer "+jwt)
-	batchRec := httptest.NewRecorder()
-	router.ServeHTTP(batchRec, batchReq)
-	if batchRec.Code != 200 {
-		t.Fatalf("batch create failed: %d %s", batchRec.Code, batchRec.Body.String())
-	}
-	var batchResp struct {
-		Data []struct {
-			ID uint `json:"id"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(batchRec.Body.Bytes(), &batchResp); err != nil {
-		t.Fatalf("unmarshal batch: %v", err)
-	}
-	if len(batchResp.Data) != 1 {
-		t.Fatalf("expected 1 node, got %d", len(batchResp.Data))
-	}
-
-	genBody, _ := json.Marshal(map[string]any{
-		"mode":         "systemd",
-		"arch":         "auto",
-		"agentVersion": "v1.7.0",
-		"downloadSrc":  "github",
-		"ttlSeconds":   900,
-	})
-	genReq := httptest.NewRequest(http.MethodPost,
-		"/api/nodes/"+formatUint(batchResp.Data[0].ID)+"/install-tokens", bytes.NewBuffer(genBody))
-	genReq.Header.Set("Content-Type", "application/json")
-	genReq.Header.Set("Authorization", "Bearer "+jwt)
-	genRec := httptest.NewRecorder()
-	router.ServeHTTP(genRec, genReq)
-	if genRec.Code != 200 {
-		t.Fatalf("install-tokens failed: %d %s", genRec.Code, genRec.Body.String())
-	}
-	var genResp struct {
-		Data struct {
-			InstallToken string `json:"installToken"`
-			URL          string `json:"url"`
-			FallbackURL  string `json:"fallbackUrl"`
-			ScriptBase64 string `json:"scriptBase64"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(genRec.Body.Bytes(), &genResp); err != nil {
-		t.Fatalf("unmarshal gen: %v", err)
-	}
-	if genResp.Data.URL != externalURL+"/api/install/"+genResp.Data.InstallToken {
-		t.Fatalf("url should use external URL, got %q", genResp.Data.URL)
-	}
-	if genResp.Data.FallbackURL != externalURL+"/install/"+genResp.Data.InstallToken {
-		t.Fatalf("fallbackUrl should use external URL, got %q", genResp.Data.FallbackURL)
-	}
-	decodedScript, err := base64.StdEncoding.DecodeString(genResp.Data.ScriptBase64)
-	if err != nil {
-		t.Fatalf("scriptBase64 should be valid base64: %v", err)
-	}
-	if !strings.Contains(string(decodedScript), `MASTER_URL="`+externalURL+`"`) {
-		t.Fatalf("script should use external MASTER_URL:\n%s", string(decodedScript))
-	}
-}
-
 func TestOneClickInstallFlow(t *testing.T) {
 	router, jwt := setupInstallFlowRouter(t)

@@ -230,8 +152,6 @@ func TestOneClickInstallFlow(t *testing.T) {
 		Data struct {
 			InstallToken string `json:"installToken"`
 			URL          string `json:"url"`
-			FallbackURL  string `json:"fallbackUrl"`
-			ScriptBase64 string `json:"scriptBase64"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal(genRec.Body.Bytes(), &genResp); err != nil {
@@ -240,16 +160,6 @@ func TestOneClickInstallFlow(t *testing.T) {
 	if genResp.Data.InstallToken == "" {
 		t.Fatalf("missing installToken")
 	}
-	if !strings.Contains(genResp.Data.FallbackURL, "/install/") {
-		t.Fatalf("missing fallback install URL, got %q", genResp.Data.FallbackURL)
-	}
-	decodedScript, err := base64.StdEncoding.DecodeString(genResp.Data.ScriptBase64)
-	if err != nil {
-		t.Fatalf("scriptBase64 should be valid base64: %v", err)
-	}
-	if !strings.Contains(string(decodedScript), "BACKUPX_AGENT_INSTALL_V1") {
-		t.Fatalf("scriptBase64 should contain rendered install script")
-	}

 	// 3. 公开端点消费
 	scriptReq := httptest.NewRequest(http.MethodGet, "/install/"+genResp.Data.InstallToken, nil)
@@ -261,22 +171,6 @@ func TestOneClickInstallFlow(t *testing.T) {
 	if !strings.Contains(scriptRec.Body.String(), "systemctl enable --now backupx-agent") {
 		t.Fatalf("script missing systemctl enable:\n%s", scriptRec.Body.String())
 	}
-	// Issue #46 防嗅探 headers：text/plain + nosniff + no-store + Content-Disposition
-	if ct := scriptRec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/plain") {
-		t.Errorf("script Content-Type should be text/plain*, got %q", ct)
-	}
-	if nosniff := scriptRec.Header().Get("X-Content-Type-Options"); nosniff != "nosniff" {
-		t.Errorf("missing X-Content-Type-Options: nosniff (got %q)", nosniff)
-	}
-	if cc := scriptRec.Header().Get("Cache-Control"); !strings.Contains(cc, "no-store") {
-		t.Errorf("missing Cache-Control: no-store (got %q)", cc)
-	}
-	if cd := scriptRec.Header().Get("Content-Disposition"); !strings.Contains(cd, "backupx-agent-install.sh") {
-		t.Errorf("Content-Disposition should name the script file (got %q)", cd)
-	}
-	if !strings.Contains(scriptRec.Body.String(), "BACKUPX_AGENT_INSTALL_V1") {
-		t.Errorf("script missing magic marker BACKUPX_AGENT_INSTALL_V1")
-	}

 	// 4. 再次消费应 410
 	scriptReq2 := httptest.NewRequest(http.MethodGet, "/install/"+genResp.Data.InstallToken, nil)
@@ -287,81 +181,6 @@ func TestOneClickInstallFlow(t *testing.T) {
 	}
 }

-// TestInstallScriptAliasUnderAPI 验证 /api/install/:token 别名路径可用，
-// 这是 Issue #46 的根本修复：让 install 端点自动命中反向代理的 /api/ 转发规则，
-// 避免 nginx SPA fallback 把请求当前端路由返回 index.html。
-func TestInstallScriptAliasUnderAPI(t *testing.T) {
-	router, token := setupInstallFlowRouter(t)
-
-	// 1. 创建一个节点，生成 install token
-	batchBody, _ := json.Marshal(map[string][]string{"names": {"alias-node"}})
-	batchReq := httptest.NewRequest(http.MethodPost, "/api/nodes/batch", bytes.NewReader(batchBody))
-	batchReq.Header.Set("Content-Type", "application/json")
-	batchReq.Header.Set("Authorization", "Bearer "+token)
-	batchRec := httptest.NewRecorder()
-	router.ServeHTTP(batchRec, batchReq)
-	if batchRec.Code != 200 {
-		t.Fatalf("batch create failed: %d %s", batchRec.Code, batchRec.Body.String())
-	}
-	var batchResp struct {
-		Data []struct {
-			ID uint `json:"id"`
-		} `json:"data"`
-	}
-	_ = json.Unmarshal(batchRec.Body.Bytes(), &batchResp)
-	if len(batchResp.Data) == 0 {
-		t.Fatalf("batch create returned no nodes: %s", batchRec.Body.String())
-	}
-	nodeID := batchResp.Data[0].ID
-
-	genBody, _ := json.Marshal(map[string]any{
-		"mode": "systemd", "arch": "auto", "agentVersion": "v1.7.0", "downloadSrc": "github", "ttlSeconds": 600,
-	})
-	genReq := httptest.NewRequest(http.MethodPost,
-		"/api/nodes/"+strconv.FormatUint(uint64(nodeID), 10)+"/install-tokens", bytes.NewReader(genBody))
-	genReq.Header.Set("Content-Type", "application/json")
-	genReq.Header.Set("Authorization", "Bearer "+token)
-	genRec := httptest.NewRecorder()
-	router.ServeHTTP(genRec, genReq)
-	if genRec.Code != 200 {
-		t.Fatalf("gen install token failed: %d %s", genRec.Code, genRec.Body.String())
-	}
-	var genResp struct {
-		Data struct {
-			InstallToken string `json:"installToken"`
-			URL          string `json:"url"`
-			FallbackURL  string `json:"fallbackUrl"`
-			ScriptBase64 string `json:"scriptBase64"`
-		} `json:"data"`
-	}
-	_ = json.Unmarshal(genRec.Body.Bytes(), &genResp)
-
-	// 2. 新生成的 url 应指向 /api/install/... —— 让反向代理的 /api/ 转发规则自动接管
-	if !strings.Contains(genResp.Data.URL, "/api/install/") {
-		t.Errorf("new install URL should use /api/install/ prefix, got %s", genResp.Data.URL)
-	}
-	if !strings.Contains(genResp.Data.FallbackURL, "/install/") {
-		t.Errorf("fallback install URL should use /install/ prefix, got %s", genResp.Data.FallbackURL)
-	}
-	if genResp.Data.ScriptBase64 == "" {
-		t.Errorf("new install response should include scriptBase64 for proxy-independent commands")
-	}
-
-	// 3. /api/install/:token 必须可消费（与 /install/:token 等价）
-	aliasReq := httptest.NewRequest(http.MethodGet, "/api/install/"+genResp.Data.InstallToken, nil)
-	aliasRec := httptest.NewRecorder()
-	router.ServeHTTP(aliasRec, aliasReq)
-	if aliasRec.Code != 200 {
-		t.Fatalf("/api/install alias failed: %d %s", aliasRec.Code, aliasRec.Body.String())
-	}
-	if !strings.Contains(aliasRec.Body.String(), "systemctl enable --now backupx-agent") {
-		t.Errorf("alias should return rendered script, got:\n%s", aliasRec.Body.String())
-	}
-	if ct := aliasRec.Header().Get("Content-Type"); !strings.HasPrefix(ct, "text/plain") {
-		t.Errorf("alias Content-Type should be text/plain*, got %q", ct)
-	}
-}
-
 func TestInstallTokenRateLimit(t *testing.T) {
 	router, jwt := setupInstallFlowRouter(t)

@@ -496,76 +315,6 @@ func TestInstallFlowComposeModeMismatch(t *testing.T) {
 	}
 }

-func TestInstallFlowComposeSuccessConsumesToken(t *testing.T) {
-	router, jwt := setupInstallFlowRouter(t)
-
-	batchBody, _ := json.Marshal(map[string][]string{"names": {"compose-ok"}})
-	batchReq := httptest.NewRequest(http.MethodPost, "/api/nodes/batch", bytes.NewBuffer(batchBody))
-	batchReq.Header.Set("Content-Type", "application/json")
-	batchReq.Header.Set("Authorization", "Bearer "+jwt)
-	batchRec := httptest.NewRecorder()
-	router.ServeHTTP(batchRec, batchReq)
-	if batchRec.Code != 200 {
-		t.Fatalf("batch create failed: %d %s", batchRec.Code, batchRec.Body.String())
-	}
-	var batchResp struct {
-		Data []struct {
-			ID uint `json:"id"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(batchRec.Body.Bytes(), &batchResp); err != nil {
-		t.Fatalf("unmarshal batch: %v", err)
-	}
-	if len(batchResp.Data) != 1 {
-		t.Fatalf("expected 1 node, got %d", len(batchResp.Data))
-	}
-
-	genBody, _ := json.Marshal(map[string]any{
-		"mode":         "docker",
-		"arch":         "auto",
-		"agentVersion": "v1.7.0",
-		"downloadSrc":  "github",
-		"ttlSeconds":   900,
-	})
-	genReq := httptest.NewRequest(http.MethodPost,
-		"/api/nodes/"+formatUint(batchResp.Data[0].ID)+"/install-tokens", bytes.NewBuffer(genBody))
-	genReq.Header.Set("Content-Type", "application/json")
-	genReq.Header.Set("Authorization", "Bearer "+jwt)
-	genRec := httptest.NewRecorder()
-	router.ServeHTTP(genRec, genReq)
-	if genRec.Code != 200 {
-		t.Fatalf("install-tokens failed: %d %s", genRec.Code, genRec.Body.String())
-	}
-	var genResp struct {
-		Data struct {
-			InstallToken string `json:"installToken"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(genRec.Body.Bytes(), &genResp); err != nil {
-		t.Fatalf("unmarshal gen: %v", err)
-	}
-	if genResp.Data.InstallToken == "" {
-		t.Fatalf("missing installToken")
-	}
-
-	composeReq := httptest.NewRequest(http.MethodGet, "/api/install/"+genResp.Data.InstallToken+"/compose.yml", nil)
-	composeRec := httptest.NewRecorder()
-	router.ServeHTTP(composeRec, composeReq)
-	if composeRec.Code != 200 {
-		t.Fatalf("compose fetch failed: %d %s", composeRec.Code, composeRec.Body.String())
-	}
-	if !strings.Contains(composeRec.Body.String(), "BACKUPX_AGENT_TOKEN") {
-		t.Fatalf("compose missing token env:\n%s", composeRec.Body.String())
-	}
-
-	scriptReq := httptest.NewRequest(http.MethodGet, "/api/install/"+genResp.Data.InstallToken, nil)
-	scriptRec := httptest.NewRecorder()
-	router.ServeHTTP(scriptRec, scriptReq)
-	if scriptRec.Code != http.StatusGone {
-		t.Fatalf("script after compose should be 410, got %d: %s", scriptRec.Code, scriptRec.Body.String())
-	}
-}
-
 // formatUint 小工具：uint → 十进制字符串（无需引入 strconv）。
 func formatUint(u uint) string {
 	if u == 0 {
--- a/server/internal/http/install_handler.go
+++ b/server/internal/http/install_handler.go
@@ -36,13 +36,6 @@ func NewInstallHandler(gcCtx context.Context, tokenService *service.InstallToken
 }

 // Script 消费 install token 并返回 shell 脚本；Mode 由 token 存储决定（systemd/docker/foreground 均返回 shell）。
-//
-// 响应头策略（issue #46 教训）：
-//   - Content-Type 用 text/plain 而非 text/x-shellscript：避免 Cloudflare/反向代理把
-//     脚本内容按特殊类型识别并触发 minify/HTML rewrite，导致 `curl | sh` 收到非脚本内容
-//   - X-Content-Type-Options: nosniff：禁止浏览器/中间层按内容嗅探改写 MIME
-//   - Cache-Control: no-store：token 一次性消费，禁止任何缓存层留存旧脚本
-//   - Content-Disposition: inline; filename=...：部分代理会跳过带文件名的响应
 func (h *InstallHandler) Script(c *gin.Context) {
 	if !h.limiter.allow(c.ClientIP()) {
 		c.String(stdhttp.StatusTooManyRequests, "请求过于频繁，请稍后再试\n")
@@ -59,15 +52,21 @@ func (h *InstallHandler) Script(c *gin.Context) {
 		return
 	}
 	h.recordConsumeAudit(c, consumed, "script")
-	script, err := renderInstallScript(resolveMasterURL(c, h.externalURL), consumed.Node, consumed.Record)
+	script, err := installscript.RenderScript(installscript.Context{
+		MasterURL:     resolveMasterURL(c, h.externalURL),
+		AgentToken:    consumed.Node.Token,
+		AgentVersion:  consumed.Record.AgentVer,
+		Mode:          consumed.Record.Mode,
+		Arch:          consumed.Record.Arch,
+		DownloadBase:  installscript.DownloadBaseFor(consumed.Record.DownloadSrc),
+		InstallPrefix: "/opt/backupx-agent",
+		NodeID:        consumed.Node.ID,
+	})
 	if err != nil {
 		c.String(stdhttp.StatusInternalServerError, "render error\n")
 		return
 	}
-	c.Header("X-Content-Type-Options", "nosniff")
-	c.Header("Cache-Control", "no-store")
-	c.Header("Content-Disposition", `inline; filename="backupx-agent-install.sh"`)
-	c.Data(stdhttp.StatusOK, "text/plain; charset=utf-8", []byte(script))
+	c.Data(stdhttp.StatusOK, "text/x-shellscript; charset=utf-8", []byte(script))
 }

 // Compose 消费 install token 并返回 docker-compose YAML，仅 Mode=docker 有效。
@@ -132,19 +131,6 @@ func (h *InstallHandler) recordConsumeAudit(c *gin.Context, consumed *service.Co
 	})
 }

-func renderInstallScript(masterURL string, node *model.Node, record *model.AgentInstallToken) (string, error) {
-	return installscript.RenderScript(installscript.Context{
-		MasterURL:     masterURL,
-		AgentToken:    node.Token,
-		AgentVersion:  record.AgentVer,
-		Mode:          record.Mode,
-		Arch:          record.Arch,
-		DownloadBase:  installscript.DownloadBaseFor(record.DownloadSrc),
-		InstallPrefix: "/opt/backupx-agent",
-		NodeID:        node.ID,
-	})
-}
-
 // resolveMasterURL 按优先级推导 Master URL：外部配置 > X-Forwarded-* > Request.Host。
 // 此为包级 helper，供 install_handler 和 node_handler 共用。
 func resolveMasterURL(c *gin.Context, externalURL string) string {
--- a/server/internal/http/middleware.go
+++ b/server/internal/http/middleware.go
@@ -1,7 +1,6 @@
 package http

 import (
-	"context"
 	stdhttp "net/http"
 	"strings"

@@ -27,94 +26,28 @@ func CORSMiddleware() gin.HandlerFunc {
 	}
 }

-// ApiKeyAuthenticator 抽象 API Key 验证能力，避免 middleware 直接依赖 service 包。
-// 实现方：service.ApiKeyService。未注入时 AuthMiddleware 仍然支持 JWT。
-type ApiKeyAuthenticator interface {
-	Authenticate(ctx context.Context, rawKey string) (subject string, role string, err error)
-}
-
-// AuthMiddleware 支持两种认证方式：
-//   - JWT (Authorization: Bearer <jwt>)：交互式用户
-//   - API Key (Authorization: Bearer bax_xxx 或 X-Api-Key: bax_xxx)：第三方脚本
-//
-// JWT 会在 context 中写入 userSubject / userRole / username；
-// API Key 会写入 authSubject=api_key:<id> / userRole=<key role>。
-func AuthMiddleware(jwtManager *security.JWTManager, apiKeyAuth ApiKeyAuthenticator) gin.HandlerFunc {
+func AuthMiddleware(jwtManager *security.JWTManager) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		rawToken := extractAuthToken(c)
-		if rawToken == "" {
+		header := strings.TrimSpace(c.GetHeader("Authorization"))
+		if !strings.HasPrefix(header, "Bearer ") {
 			response.Error(c, apperror.Unauthorized("AUTH_REQUIRED", "请先登录", nil))
 			c.Abort()
 			return
 		}
-		if apiKeyAuth != nil && strings.HasPrefix(rawToken, "bax_") {
-			subject, role, err := apiKeyAuth.Authenticate(c.Request.Context(), rawToken)
-			if err != nil {
-				response.Error(c, err)
-				c.Abort()
-				return
-			}
-			c.Set(contextAuthSubjectKey, subject)
-			c.Set(contextUserRoleKey, role)
-			c.Set(contextUserSubjectKey, subject)
-			c.Set(contextUsernameKey, subject)
-			c.Next()
-			return
-		}
-		claims, err := jwtManager.Parse(rawToken)
+
+		tokenString := strings.TrimSpace(strings.TrimPrefix(header, "Bearer "))
+		claims, err := jwtManager.Parse(tokenString)
 		if err != nil {
 			response.Error(c, apperror.Unauthorized("AUTH_INVALID_TOKEN", "登录状态已失效，请重新登录", err))
 			c.Abort()
 			return
 		}
+
 		c.Set(contextUserSubjectKey, claims.Subject)
-		c.Set(contextUserRoleKey, claims.Role)
-		c.Set(contextUsernameKey, claims.Username)
-		c.Set(contextAuthSubjectKey, "user:"+claims.Subject)
 		c.Next()
 	}
 }

-// extractAuthToken 从 Authorization: Bearer 或 X-Api-Key 中提取原始 token。
-func extractAuthToken(c *gin.Context) string {
-	header := strings.TrimSpace(c.GetHeader("Authorization"))
-	if strings.HasPrefix(header, "Bearer ") {
-		return strings.TrimSpace(strings.TrimPrefix(header, "Bearer "))
-	}
-	if key := strings.TrimSpace(c.GetHeader("X-Api-Key")); key != "" {
-		return key
-	}
-	return ""
-}
-
-// RequireRole 仅放行指定角色，否则返回 403。
-// 必须用在 AuthMiddleware 之后。viewer 只读保护、admin 管理端都靠它。
-func RequireRole(roles ...string) gin.HandlerFunc {
-	allowed := make(map[string]bool, len(roles))
-	for _, r := range roles {
-		allowed[strings.ToLower(r)] = true
-	}
-	return func(c *gin.Context) {
-		role, _ := c.Get(contextUserRoleKey)
-		roleStr := ""
-		if v, ok := role.(string); ok {
-			roleStr = strings.ToLower(v)
-		}
-		if !allowed[roleStr] {
-			response.Error(c, apperror.New(403, "AUTH_FORBIDDEN", "当前角色无权执行此操作", nil))
-			c.Abort()
-			return
-		}
-		c.Next()
-	}
-}
-
-// RequireNotViewer 是 RequireRole(admin, operator) 的快捷方式，
-// 用于任何"写入/变更"类端点，禁止 viewer 触发。
-func RequireNotViewer() gin.HandlerFunc {
-	return RequireRole("admin", "operator")
-}
-
 func ClientKey(c *gin.Context) string {
 	ip := strings.TrimSpace(c.ClientIP())
 	if ip == "" {
--- a/server/internal/http/node_handler.go
+++ b/server/internal/http/node_handler.go
@@ -244,17 +244,14 @@ func (h *NodeHandler) CreateInstallToken(c *gin.Context) {
 		input.TTLSeconds = 900
 	}

-	out, err := h.installTokenSvc.CreateCommand(c.Request.Context(), service.InstallCommandInput{
-		InstallTokenInput: service.InstallTokenInput{
-			NodeID:       uint(id),
-			Mode:         input.Mode,
-			Arch:         input.Arch,
-			AgentVersion: input.AgentVersion,
-			DownloadSrc:  input.DownloadSrc,
-			TTLSeconds:   input.TTLSeconds,
-			CreatedByID:  h.resolveCurrentUserID(c),
-		},
-		MasterURL: resolveMasterURL(c, h.externalURL),
+	out, err := h.installTokenSvc.Create(c.Request.Context(), service.InstallTokenInput{
+		NodeID:       uint(id),
+		Mode:         input.Mode,
+		Arch:         input.Arch,
+		AgentVersion: input.AgentVersion,
+		DownloadSrc:  input.DownloadSrc,
+		TTLSeconds:   input.TTLSeconds,
+		CreatedByID:  h.resolveCurrentUserID(c),
 	})
 	if err != nil {
 		response.Error(c, err)
@@ -264,19 +261,15 @@ func (h *NodeHandler) CreateInstallToken(c *gin.Context) {
 		fmt.Sprintf("%d", id), out.Node.Name,
 		fmt.Sprintf("生成 %s/%s install token TTL=%ds", input.Mode, input.Arch, input.TTLSeconds))

-	// 使用 /api/install/... 而非 /install/... —— 让反向代理的 /api/ 转发规则
-	// 自动接管，避免 SPA fallback 把请求当成前端路由返回 index.html（issue #46）。
-	// 同时返回 /install/... 备用地址，兼容会剥离 /api 前缀的外层反向代理。
-	// scriptBase64 让前端可以生成不依赖公开下载路径的嵌入式命令，解决 Lucky 等代理
-	// 把 /api/install/* 也 fallback 到 index.html 的场景。
+	masterURL := resolveMasterURL(c, h.externalURL)
 	body := gin.H{
-		"installToken":       out.Token,
-		"expiresAt":          out.ExpiresAt,
-		"url":                out.URL,
-		"fallbackUrl":        out.FallbackURL,
-		"scriptBase64":       out.ScriptBase64,
-		"composeUrl":         out.ComposeURL,
-		"fallbackComposeUrl": out.FallbackComposeURL,
+		"installToken": out.Token,
+		"expiresAt":    out.ExpiresAt,
+		"url":          masterURL + "/install/" + out.Token,
+		"composeUrl":   "",
+	}
+	if input.Mode == "docker" {
+		body["composeUrl"] = masterURL + "/install/" + out.Token + "/compose.yml"
 	}
 	response.Success(c, body)
 }
--- a/server/internal/http/replication_handler.go
+++ b/server/internal/http/replication_handler.go
@@ -1,128 +0,0 @@
-package http
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// ReplicationHandler 管理备份复制记录列表 + 手动触发。
-type ReplicationHandler struct {
-	service      *service.ReplicationService
-	auditService *service.AuditService
-}
-
-func NewReplicationHandler(replicationService *service.ReplicationService, auditService *service.AuditService) *ReplicationHandler {
-	return &ReplicationHandler{service: replicationService, auditService: auditService}
-}
-
-// TriggerByRecord 手动触发：从备份记录复制到指定目标存储。
-// Body: {"destTargetId": 12}
-func (h *ReplicationHandler) TriggerByRecord(c *gin.Context) {
-	recordID, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input struct {
-		DestTargetID uint `json:"destTargetId" binding:"required,min=1"`
-	}
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("REPLICATION_INVALID", "复制参数不合法", err))
-		return
-	}
-	triggeredBy := ""
-	if subject, exists := c.Get(contextUsernameKey); exists {
-		if v, ok := subject.(string); ok {
-			triggeredBy = v
-		}
-	}
-	if triggeredBy == "" {
-		triggeredBy = "manual"
-	}
-	result, err := h.service.Start(c.Request.Context(), recordID, input.DestTargetID, triggeredBy)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "replication", "manual_run", "backup_record", fmt.Sprintf("%d", recordID), "",
-		fmt.Sprintf("手动触发复制（备份记录 #%d → 存储 #%d, 复制记录 #%d）", recordID, input.DestTargetID, result.ID))
-	response.Success(c, result)
-}
-
-func (h *ReplicationHandler) List(c *gin.Context) {
-	filter, err := buildReplicationFilter(c)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	items, err := h.service.List(c.Request.Context(), filter)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *ReplicationHandler) Get(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	item, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, item)
-}
-
-func buildReplicationFilter(c *gin.Context) (service.ReplicationRecordListInput, error) {
-	var filter service.ReplicationRecordListInput
-	if v := strings.TrimSpace(c.Query("taskId")); v != "" {
-		parsed, err := strconv.ParseUint(v, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("REPLICATION_FILTER_INVALID", "taskId 不合法", err)
-		}
-		id := uint(parsed)
-		filter.TaskID = &id
-	}
-	if v := strings.TrimSpace(c.Query("backupRecordId")); v != "" {
-		parsed, err := strconv.ParseUint(v, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("REPLICATION_FILTER_INVALID", "backupRecordId 不合法", err)
-		}
-		id := uint(parsed)
-		filter.BackupRecordID = &id
-	}
-	if v := strings.TrimSpace(c.Query("destTargetId")); v != "" {
-		parsed, err := strconv.ParseUint(v, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("REPLICATION_FILTER_INVALID", "destTargetId 不合法", err)
-		}
-		id := uint(parsed)
-		filter.DestTargetID = &id
-	}
-	filter.Status = strings.TrimSpace(c.Query("status"))
-	if v := strings.TrimSpace(c.Query("dateFrom")); v != "" {
-		parsed, err := time.Parse(time.RFC3339, v)
-		if err != nil {
-			return filter, apperror.BadRequest("REPLICATION_FILTER_INVALID", "dateFrom 必须为 RFC3339", err)
-		}
-		filter.DateFrom = &parsed
-	}
-	if v := strings.TrimSpace(c.Query("dateTo")); v != "" {
-		parsed, err := time.Parse(time.RFC3339, v)
-		if err != nil {
-			return filter, apperror.BadRequest("REPLICATION_FILTER_INVALID", "dateTo 必须为 RFC3339", err)
-		}
-		filter.DateTo = &parsed
-	}
-	return filter, nil
-}
--- a/server/internal/http/report_handler.go
+++ b/server/internal/http/report_handler.go
@@ -1,95 +0,0 @@
-package http
-
-import (
-	"encoding/csv"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-	"github.com/gin-gonic/gin"
-)
-
-type ReportHandler struct {
-	service *service.ReportService
-}
-
-func NewReportHandler(reportService *service.ReportService) *ReportHandler {
-	return &ReportHandler{service: reportService}
-}
-
-func reportDays(c *gin.Context) int {
-	days := 30
-	if v := strings.TrimSpace(c.Query("days")); v != "" {
-		if parsed, err := strconv.Atoi(v); err == nil && parsed > 0 {
-			days = parsed
-		}
-	}
-	return days
-}
-
-// Compliance 返回 JSON 合规报表（按任务的备份合规证据 + 汇总）。
-func (h *ReportHandler) Compliance(c *gin.Context) {
-	payload, err := h.service.ComplianceReport(c.Request.Context(), reportDays(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, payload)
-}
-
-// ComplianceCSV 把合规报表导出为 CSV（供审计归档）。带 UTF-8 BOM 以便 Excel 正确识别中文。
-func (h *ReportHandler) ComplianceCSV(c *gin.Context) {
-	report, err := h.service.ComplianceReport(c.Request.Context(), reportDays(c))
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	filename := fmt.Sprintf("backupx-compliance-%s.csv", report.GeneratedAt.Format("20060102-150405"))
-	c.Header("Content-Type", "text/csv; charset=utf-8")
-	c.Header("Content-Disposition", "attachment; filename="+filename)
-	_, _ = c.Writer.WriteString("\ufeff") // UTF-8 BOM
-	w := csv.NewWriter(c.Writer)
-	_ = w.Write([]string{
-		"任务ID", "任务名", "类型", "启用", "节点", "加密", "保留天数", "SLA(RPO小时)",
-		"周期内运行", "成功", "失败", "成功率", "最近状态", "最近运行(UTC)", "最近成功(UTC)", "保护字节数", "合规判定",
-	})
-	for _, row := range report.Tasks {
-		_ = w.Write([]string{
-			strconv.FormatUint(uint64(row.TaskID), 10),
-			row.TaskName,
-			row.Type,
-			boolCN(row.Enabled),
-			row.NodeName,
-			boolCN(row.Encrypted),
-			strconv.Itoa(row.RetentionDays),
-			strconv.Itoa(row.SLAHoursRPO),
-			strconv.Itoa(row.TotalRuns),
-			strconv.Itoa(row.Successes),
-			strconv.Itoa(row.Failures),
-			fmt.Sprintf("%.2f%%", row.SuccessRate*100),
-			row.LastStatus,
-			fmtTimePtr(row.LastRunAt),
-			fmtTimePtr(row.LastSuccessAt),
-			strconv.FormatInt(row.ProtectedBytes, 10),
-			row.Risk,
-		})
-	}
-	w.Flush()
-}
-
-func boolCN(b bool) string {
-	if b {
-		return "是"
-	}
-	return "否"
-}
-
-func fmtTimePtr(t *time.Time) string {
-	if t == nil {
-		return ""
-	}
-	return t.UTC().Format("2006-01-02 15:04:05")
-}
--- a/server/internal/http/restore_record_handler.go
+++ b/server/internal/http/restore_record_handler.go
@@ -1,162 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-	"time"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/backup"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// RestoreRecordHandler 提供恢复记录列表/详情/实时日志端点。
-// 创建恢复由 BackupRecordHandler.Restore 代理到 RestoreService.Start。
-type RestoreRecordHandler struct {
-	service      *service.RestoreService
-	auditService *service.AuditService
-}
-
-func NewRestoreRecordHandler(restoreService *service.RestoreService, auditService *service.AuditService) *RestoreRecordHandler {
-	return &RestoreRecordHandler{service: restoreService, auditService: auditService}
-}
-
-func (h *RestoreRecordHandler) List(c *gin.Context) {
-	filter, err := buildRestoreFilter(c)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	items, err := h.service.List(c.Request.Context(), filter)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *RestoreRecordHandler) Get(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	item, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, item)
-}
-
-func (h *RestoreRecordHandler) StreamLogs(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	detail, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	events := detail.LogEvents
-	completed := detail.Status != "running"
-	channel, cancel, err := h.service.SubscribeLogs(c.Request.Context(), id, 64)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	defer cancel()
-	c.Writer.Header().Set("Content-Type", "text/event-stream")
-	c.Writer.Header().Set("Cache-Control", "no-cache")
-	c.Writer.Header().Set("Connection", "keep-alive")
-	flusher, ok := c.Writer.(interface{ Flush() })
-	if !ok {
-		response.Error(c, apperror.Internal("RESTORE_STREAM_UNSUPPORTED", "当前连接不支持日志流", nil))
-		return
-	}
-	for _, event := range events {
-		if err := writeRestoreSSEEvent(c.Writer, event); err != nil {
-			return
-		}
-		flusher.Flush()
-	}
-	if completed {
-		return
-	}
-	for {
-		select {
-		case <-c.Request.Context().Done():
-			return
-		case event, ok := <-channel:
-			if !ok {
-				return
-			}
-			if err := writeRestoreSSEEvent(c.Writer, event); err != nil {
-				return
-			}
-			flusher.Flush()
-			if event.Completed {
-				return
-			}
-		}
-	}
-}
-
-func buildRestoreFilter(c *gin.Context) (service.RestoreRecordListInput, error) {
-	var filter service.RestoreRecordListInput
-	if taskIDValue := strings.TrimSpace(c.Query("taskId")); taskIDValue != "" {
-		parsed, err := strconv.ParseUint(taskIDValue, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("RESTORE_RECORD_FILTER_INVALID", "taskId 不合法", err)
-		}
-		v := uint(parsed)
-		filter.TaskID = &v
-	}
-	if backupValue := strings.TrimSpace(c.Query("backupRecordId")); backupValue != "" {
-		parsed, err := strconv.ParseUint(backupValue, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("RESTORE_RECORD_FILTER_INVALID", "backupRecordId 不合法", err)
-		}
-		v := uint(parsed)
-		filter.BackupRecordID = &v
-	}
-	if nodeValue := strings.TrimSpace(c.Query("nodeId")); nodeValue != "" {
-		parsed, err := strconv.ParseUint(nodeValue, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("RESTORE_RECORD_FILTER_INVALID", "nodeId 不合法", err)
-		}
-		v := uint(parsed)
-		filter.NodeID = &v
-	}
-	filter.Status = strings.TrimSpace(c.Query("status"))
-	if dateFrom := strings.TrimSpace(c.Query("dateFrom")); dateFrom != "" {
-		parsed, err := time.Parse(time.RFC3339, dateFrom)
-		if err != nil {
-			return filter, apperror.BadRequest("RESTORE_RECORD_FILTER_INVALID", "dateFrom 必须为 RFC3339 时间格式", err)
-		}
-		filter.DateFrom = &parsed
-	}
-	if dateTo := strings.TrimSpace(c.Query("dateTo")); dateTo != "" {
-		parsed, err := time.Parse(time.RFC3339, dateTo)
-		if err != nil {
-			return filter, apperror.BadRequest("RESTORE_RECORD_FILTER_INVALID", "dateTo 必须为 RFC3339 时间格式", err)
-		}
-		filter.DateTo = &parsed
-	}
-	return filter, nil
-}
-
-func writeRestoreSSEEvent(writer io.Writer, event backup.LogEvent) error {
-	payload, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-	_, err = fmt.Fprintf(writer, "event: log\ndata: %s\n\n", payload)
-	return err
-}
--- a/server/internal/http/router.go
+++ b/server/internal/http/router.go
@@ -7,14 +7,12 @@ import (

 	"backupx/server/internal/apperror"
 	"backupx/server/internal/config"
-	"backupx/server/internal/metrics"
 	"backupx/server/internal/repository"
 	"backupx/server/internal/security"
 	"backupx/server/internal/service"
 	"backupx/server/pkg/response"
 	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
-	"gorm.io/gorm"
 )

 type RouterDependencies struct {
@@ -30,18 +28,8 @@ type RouterDependencies struct {
 	BackupTaskService        *service.BackupTaskService
 	BackupExecutionService   *service.BackupExecutionService
 	BackupRecordService      *service.BackupRecordService
-	RestoreService           *service.RestoreService
-	VerificationService      *service.VerificationService
-	ReplicationService       *service.ReplicationService
-	TaskTemplateService      *service.TaskTemplateService
-	TaskExportService        *service.TaskExportService
-	SearchService            *service.SearchService
-	EventBroadcaster         *service.EventBroadcaster
-	UserService              *service.UserService
-	ApiKeyService            *service.ApiKeyService
 	NotificationService      *service.NotificationService
 	DashboardService         *service.DashboardService
-	ReportService            *service.ReportService
 	SettingsService          *service.SettingsService
 	NodeService              *service.NodeService
 	AgentService             *service.AgentService
@@ -52,10 +40,6 @@ type RouterDependencies struct {
 	SystemConfigRepo         repository.SystemConfigRepository
 	InstallTokenService      *service.InstallTokenService
 	MasterExternalURL        string
-	// DB 注入给健康检查端点做 liveness/readiness 探测。
-	DB *gorm.DB
-	// Metrics 注入给 /metrics 端点；为 nil 时端点返回 503。
-	Metrics *metrics.Metrics
 }

 func NewRouter(deps RouterDependencies) *gin.Engine {
@@ -70,19 +54,7 @@ func NewRouter(deps RouterDependencies) *gin.Engine {
 	storageTargetHandler := NewStorageTargetHandler(deps.StorageTargetService, deps.AuditService)
 	backupTaskHandler := NewBackupTaskHandler(deps.BackupTaskService, deps.AuditService)
 	backupRunHandler := NewBackupRunHandler(deps.BackupExecutionService, deps.AuditService)
-	backupRecordHandler := NewBackupRecordHandler(deps.BackupRecordService, deps.RestoreService, deps.AuditService)
-	restoreRecordHandler := NewRestoreRecordHandler(deps.RestoreService, deps.AuditService)
-	verificationHandler := NewVerificationHandler(deps.VerificationService, deps.AuditService)
-	replicationHandler := NewReplicationHandler(deps.ReplicationService, deps.AuditService)
-	taskTemplateHandler := NewTaskTemplateHandler(deps.TaskTemplateService, deps.AuditService)
-	userHandler := NewUserHandler(deps.UserService, deps.AuditService)
-	apiKeyHandler := NewApiKeyHandler(deps.ApiKeyService, deps.AuditService)
-	// apiKeyAuth：给 AuthMiddleware 注入 API Key 验证能力。
-	// 为 nil 时中间件仅支持 JWT，不影响向后兼容。
-	var apiKeyAuth ApiKeyAuthenticator
-	if deps.ApiKeyService != nil {
-		apiKeyAuth = deps.ApiKeyService
-	}
+	backupRecordHandler := NewBackupRecordHandler(deps.BackupRecordService, deps.AuditService)
 	notificationHandler := NewNotificationHandler(deps.NotificationService)
 	dashboardHandler := NewDashboardHandler(deps.DashboardService)
 	settingsHandler := NewSettingsHandler(deps.SettingsService, deps.AuditService)
@@ -95,235 +67,109 @@ func NewRouter(deps RouterDependencies) *gin.Engine {
 			auth.GET("/setup/status", authHandler.SetupStatus)
 			auth.POST("/setup", authHandler.Setup)
 			auth.POST("/login", authHandler.Login)
-			auth.POST("/otp/send", authHandler.SendLoginOTP)
-			auth.POST("/webauthn/login/options", authHandler.BeginWebAuthnLogin)
-			auth.POST("/logout", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.Logout)
-			auth.GET("/profile", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.Profile)
-			auth.PUT("/password", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.ChangePassword)
-			auth.POST("/2fa/setup", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.PrepareTwoFactor)
-			auth.POST("/2fa/enable", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.EnableTwoFactor)
-			auth.POST("/2fa/recovery-codes", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.RegenerateRecoveryCodes)
-			auth.DELETE("/2fa", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.DisableTwoFactor)
-			auth.PUT("/otp/config", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.ConfigureOTP)
-			auth.POST("/webauthn/register/options", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.BeginWebAuthnRegistration)
-			auth.POST("/webauthn/register/finish", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.FinishWebAuthnRegistration)
-			auth.GET("/webauthn/credentials", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.ListWebAuthnCredentials)
-			auth.DELETE("/webauthn/credentials/:id", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.DeleteWebAuthnCredential)
-			auth.GET("/trusted-devices", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.ListTrustedDevices)
-			auth.DELETE("/trusted-devices/:id", AuthMiddleware(deps.JWTManager, apiKeyAuth), authHandler.RevokeTrustedDevice)
+			auth.POST("/logout", AuthMiddleware(deps.JWTManager), authHandler.Logout)
+			auth.GET("/profile", AuthMiddleware(deps.JWTManager), authHandler.Profile)
+			auth.PUT("/password", AuthMiddleware(deps.JWTManager), authHandler.ChangePassword)
 		}

 		system := api.Group("/system")
-		system.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		system.Use(AuthMiddleware(deps.JWTManager))
 		system.GET("/info", systemHandler.Info)
 		system.GET("/update-check", systemHandler.CheckUpdate)

 		storageTargets := api.Group("/storage-targets")
-		storageTargets.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		storageTargets.Use(AuthMiddleware(deps.JWTManager))
 		// 静态路由必须在参数路由 /:id 之前注册，避免 Gin 路由冲突
 		storageTargets.GET("", storageTargetHandler.List)
-		storageTargets.POST("", RequireNotViewer(), storageTargetHandler.Create)
-		storageTargets.POST("/test", RequireNotViewer(), storageTargetHandler.TestConnection)
-		storageTargets.POST("/google-drive/auth-url", RequireNotViewer(), storageTargetHandler.StartGoogleDriveOAuth)
-		storageTargets.POST("/google-drive/complete", RequireNotViewer(), storageTargetHandler.CompleteGoogleDriveOAuth)
+		storageTargets.POST("", storageTargetHandler.Create)
+		storageTargets.POST("/test", storageTargetHandler.TestConnection)
+		storageTargets.POST("/google-drive/auth-url", storageTargetHandler.StartGoogleDriveOAuth)
+		storageTargets.POST("/google-drive/complete", storageTargetHandler.CompleteGoogleDriveOAuth)
 		storageTargets.GET("/google-drive/callback", storageTargetHandler.HandleGoogleDriveCallback)
 		rcloneHandler := NewRcloneHandler()
 		storageTargets.GET("/rclone/backends", rcloneHandler.ListBackends)
 		// 参数路由
 		storageTargets.GET("/:id", storageTargetHandler.Get)
-		storageTargets.PUT("/:id", RequireNotViewer(), storageTargetHandler.Update)
-		storageTargets.DELETE("/:id", RequireNotViewer(), storageTargetHandler.Delete)
-		storageTargets.PUT("/:id/star", RequireNotViewer(), storageTargetHandler.ToggleStar)
-		storageTargets.POST("/:id/test", RequireNotViewer(), storageTargetHandler.TestSavedConnection)
+		storageTargets.PUT("/:id", storageTargetHandler.Update)
+		storageTargets.DELETE("/:id", storageTargetHandler.Delete)
+		storageTargets.PUT("/:id/star", storageTargetHandler.ToggleStar)
+		storageTargets.POST("/:id/test", storageTargetHandler.TestSavedConnection)
 		storageTargets.GET("/:id/usage", storageTargetHandler.GetUsage)
 		storageTargets.GET("/:id/google-drive/profile", storageTargetHandler.GoogleDriveProfile)

 		backupTasks := api.Group("/backup/tasks")
-		backupTasks.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		backupTasks.Use(AuthMiddleware(deps.JWTManager))
 		backupTasks.GET("", backupTaskHandler.List)
-		backupTasks.GET("/tags", backupTaskHandler.ListTags)
 		backupTasks.GET("/:id", backupTaskHandler.Get)
-		backupTasks.POST("", RequireNotViewer(), backupTaskHandler.Create)
-		backupTasks.PUT("/:id", RequireNotViewer(), backupTaskHandler.Update)
-		backupTasks.DELETE("/:id", RequireNotViewer(), backupTaskHandler.Delete)
-		backupTasks.PUT("/:id/toggle", RequireNotViewer(), backupTaskHandler.Toggle)
-		backupTasks.POST("/:id/run", RequireNotViewer(), backupRunHandler.Run)
-		backupTasks.POST("/batch/toggle", RequireNotViewer(), backupTaskHandler.BatchToggle)
-		backupTasks.POST("/batch/delete", RequireNotViewer(), backupTaskHandler.BatchDelete)
-		backupTasks.POST("/batch/run", RequireNotViewer(), backupRunHandler.BatchRun)
-		// 任务配置导入/导出（集群迁移 & 灾备）
-		if deps.TaskExportService != nil {
-			taskExportHandler := NewTaskExportHandler(deps.TaskExportService, deps.AuditService)
-			backupTasks.GET("/export", taskExportHandler.Export)
-			backupTasks.POST("/import", RequireNotViewer(), taskExportHandler.Import)
-		}
-		if deps.VerificationService != nil {
-			backupTasks.POST("/:id/verify", RequireNotViewer(), verificationHandler.TriggerByTask)
-		}
+		backupTasks.POST("", backupTaskHandler.Create)
+		backupTasks.PUT("/:id", backupTaskHandler.Update)
+		backupTasks.DELETE("/:id", backupTaskHandler.Delete)
+		backupTasks.PUT("/:id/toggle", backupTaskHandler.Toggle)
+		backupTasks.POST("/:id/run", backupRunHandler.Run)

 		backupRecords := api.Group("/backup/records")
-		backupRecords.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		backupRecords.Use(AuthMiddleware(deps.JWTManager))
 		backupRecords.GET("", backupRecordHandler.List)
 		backupRecords.GET("/:id", backupRecordHandler.Get)
 		backupRecords.GET("/:id/logs/stream", backupRecordHandler.StreamLogs)
 		backupRecords.GET("/:id/download", backupRecordHandler.Download)
-		backupRecords.GET("/:id/contents", backupRecordHandler.Contents)
-		backupRecords.POST("/:id/restore", RequireNotViewer(), backupRecordHandler.Restore)
-		backupRecords.POST("/batch-delete", RequireNotViewer(), backupRecordHandler.BatchDelete)
-		backupRecords.DELETE("/:id", RequireNotViewer(), backupRecordHandler.Delete)
-		backupRecords.PUT("/:id/lock", RequireNotViewer(), backupRecordHandler.SetLock)
-
-		// 恢复记录独立命名空间：列表/详情/SSE 日志流。
-		// 创建恢复仍然走 POST /backup/records/:id/restore（以源备份记录为触发点）。
-		if deps.RestoreService != nil {
-			restoreRecords := api.Group("/restore/records")
-			restoreRecords.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			restoreRecords.GET("", restoreRecordHandler.List)
-			restoreRecords.GET("/:id", restoreRecordHandler.Get)
-			restoreRecords.GET("/:id/logs/stream", restoreRecordHandler.StreamLogs)
-		}
-
-		// 备份复制记录（3-2-1 规则）
-		if deps.ReplicationService != nil {
-			replicationRecords := api.Group("/replication/records")
-			replicationRecords.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			replicationRecords.GET("", replicationHandler.List)
-			replicationRecords.GET("/:id", replicationHandler.Get)
-			backupRecords.POST("/:id/replicate", RequireNotViewer(), replicationHandler.TriggerByRecord)
-		}
-
-		// 任务模板（批量创建）
-		if deps.TaskTemplateService != nil {
-			templates := api.Group("/task-templates")
-			templates.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			templates.GET("", taskTemplateHandler.List)
-			templates.GET("/:id", taskTemplateHandler.Get)
-			templates.POST("", RequireNotViewer(), taskTemplateHandler.Create)
-			templates.PUT("/:id", RequireNotViewer(), taskTemplateHandler.Update)
-			templates.DELETE("/:id", RequireNotViewer(), taskTemplateHandler.Delete)
-			templates.POST("/:id/apply", RequireNotViewer(), taskTemplateHandler.Apply)
-		}
-
-		// 备份验证/演练记录
-		if deps.VerificationService != nil {
-			verifyRecords := api.Group("/verify/records")
-			verifyRecords.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			verifyRecords.GET("", verificationHandler.List)
-			verifyRecords.GET("/:id", verificationHandler.Get)
-			verifyRecords.GET("/:id/logs/stream", verificationHandler.StreamLogs)
-			// 基于备份记录的验证入口：与 restore 对称
-			backupRecords.POST("/:id/verify", RequireNotViewer(), verificationHandler.TriggerByRecord)
-		}
-		// 企业合规报表：按任务的可导出备份合规证据（区别于 Dashboard 的实时聚合视图）。
-		if deps.ReportService != nil {
-			reportHandler := NewReportHandler(deps.ReportService)
-			reports := api.Group("/reports")
-			reports.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			reports.GET("/compliance", reportHandler.Compliance)
-			reports.GET("/compliance/export", reportHandler.ComplianceCSV)
-		}
-
+		backupRecords.POST("/:id/restore", backupRecordHandler.Restore)
+		backupRecords.POST("/batch-delete", backupRecordHandler.BatchDelete)
+		backupRecords.DELETE("/:id", backupRecordHandler.Delete)
 		dashboard := api.Group("/dashboard")
-		dashboard.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		dashboard.Use(AuthMiddleware(deps.JWTManager))
 		dashboard.GET("/stats", dashboardHandler.Stats)
 		dashboard.GET("/timeline", dashboardHandler.Timeline)
-		dashboard.GET("/sla", dashboardHandler.SLA)
-		dashboard.GET("/cluster", dashboardHandler.Cluster)
-		dashboard.GET("/breakdown", dashboardHandler.Breakdown)
-		dashboard.GET("/node-performance", dashboardHandler.NodePerformance)

 		notifications := api.Group("/notifications")
-		notifications.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		notifications.Use(AuthMiddleware(deps.JWTManager))
 		notifications.GET("", notificationHandler.List)
 		notifications.GET("/:id", notificationHandler.Get)
-		notifications.POST("", RequireNotViewer(), notificationHandler.Create)
-		notifications.PUT("/:id", RequireNotViewer(), notificationHandler.Update)
-		notifications.DELETE("/:id", RequireNotViewer(), notificationHandler.Delete)
-		notifications.POST("/test", RequireNotViewer(), notificationHandler.Test)
-		notifications.POST("/:id/test", RequireNotViewer(), notificationHandler.TestSaved)
+		notifications.POST("", notificationHandler.Create)
+		notifications.PUT("/:id", notificationHandler.Update)
+		notifications.DELETE("/:id", notificationHandler.Delete)
+		notifications.POST("/test", notificationHandler.Test)
+		notifications.POST("/:id/test", notificationHandler.TestSaved)

 		settings := api.Group("/settings")
-		settings.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		settings.Use(AuthMiddleware(deps.JWTManager))
 		settings.GET("", settingsHandler.Get)
-		settings.PUT("", RequireRole("admin"), settingsHandler.Update)
-
-		// 用户管理（admin 专属）
-		if deps.UserService != nil {
-			users := api.Group("/users")
-			users.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth), RequireRole("admin"))
-			users.GET("", userHandler.List)
-			users.POST("", userHandler.Create)
-			users.PUT("/:id", userHandler.Update)
-			users.POST("/:id/2fa/reset", userHandler.ResetTwoFactor)
-			users.DELETE("/:id", userHandler.Delete)
-		}
-
-		// API Key 管理（admin 专属）
-		if deps.ApiKeyService != nil {
-			apiKeys := api.Group("/api-keys")
-			apiKeys.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth), RequireRole("admin"))
-			apiKeys.GET("", apiKeyHandler.List)
-			apiKeys.POST("", apiKeyHandler.Create)
-			apiKeys.PUT("/:id/toggle", apiKeyHandler.Toggle)
-			apiKeys.DELETE("/:id", apiKeyHandler.Revoke)
-		}
+		settings.PUT("", settingsHandler.Update)

 		auditLogs := api.Group("/audit-logs")
-		auditLogs.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		auditLogs.Use(AuthMiddleware(deps.JWTManager))
 		auditLogs.GET("", auditHandler.List)
-		auditLogs.GET("/export", auditHandler.Export)
-
-		// 实时事件 SSE 流（Dashboard 自刷新、桌面告警）
-		if deps.EventBroadcaster != nil {
-			eventsHandler := NewEventsHandler(deps.EventBroadcaster)
-			events := api.Group("/events")
-			events.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			events.GET("/stream", eventsHandler.Stream)
-		}
-
-		// 全局搜索
-		if deps.SearchService != nil {
-			searchHandler := NewSearchHandler(deps.SearchService)
-			searchGroup := api.Group("/search")
-			searchGroup.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
-			searchGroup.GET("", searchHandler.Search)
-		}

 		if deps.DatabaseDiscoveryService != nil {
 			databaseHandler := NewDatabaseHandler(deps.DatabaseDiscoveryService)
 			database := api.Group("/database")
-			database.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+			database.Use(AuthMiddleware(deps.JWTManager))
 			database.POST("/discover", databaseHandler.Discover)
 		}

 		nodeHandler := NewNodeHandler(deps.NodeService, deps.AuditService, deps.InstallTokenService, deps.UserRepository, deps.MasterExternalURL)
 		nodes := api.Group("/nodes")
-		nodes.Use(AuthMiddleware(deps.JWTManager, apiKeyAuth))
+		nodes.Use(AuthMiddleware(deps.JWTManager))
 		nodes.GET("", nodeHandler.List)
 		nodes.GET("/:id", nodeHandler.Get)
-		nodes.POST("", RequireRole("admin"), nodeHandler.Create)
-		nodes.PUT("/:id", RequireRole("admin"), nodeHandler.Update)
-		nodes.DELETE("/:id", RequireRole("admin"), nodeHandler.Delete)
-		// 文件浏览会枚举节点文件系统目录（含 /etc、/root 等），属敏感读操作：
-		// 限制为非 viewer（admin/operator），与"创建备份任务需选源路径"的权限对齐，
-		// 避免只读 viewer 借此探查服务器目录结构。
-		nodes.GET("/:id/fs/list", RequireNotViewer(), nodeHandler.ListDirectory)
-		nodes.POST("/batch", RequireRole("admin"), nodeHandler.BatchCreate)
-		nodes.POST("/:id/install-tokens", RequireRole("admin"), nodeHandler.CreateInstallToken)
-		nodes.POST("/:id/rotate-token", RequireRole("admin"), nodeHandler.RotateToken)
-		nodes.GET("/:id/install-script-preview", RequireRole("admin"), nodeHandler.PreviewScript)
+		nodes.POST("", nodeHandler.Create)
+		nodes.PUT("/:id", nodeHandler.Update)
+		nodes.DELETE("/:id", nodeHandler.Delete)
+		nodes.GET("/:id/fs/list", nodeHandler.ListDirectory)
+			nodes.POST("/batch", nodeHandler.BatchCreate)
+			nodes.POST("/:id/install-tokens", nodeHandler.CreateInstallToken)
+			nodes.POST("/:id/rotate-token", nodeHandler.RotateToken)
+			nodes.GET("/:id/install-script-preview", nodeHandler.PreviewScript)

 		// Agent API（token 认证，无需 JWT）
 		if deps.AgentService != nil {
-			agentHandler := NewAgentHandler(deps.AgentService, deps.NodeService, deps.RestoreService)
+			agentHandler := NewAgentHandler(deps.AgentService, deps.NodeService)
 			agent := api.Group("/agent")
 			agent.POST("/heartbeat", agentHandler.Heartbeat)
 			agent.POST("/commands/poll", agentHandler.Poll)
 			agent.POST("/commands/:id/result", agentHandler.SubmitCommandResult)
 			agent.GET("/tasks/:id", agentHandler.GetTaskSpec)
 			agent.POST("/records/:id", agentHandler.UpdateRecord)
-			agent.GET("/restores/:id/spec", agentHandler.GetRestoreSpec)
-			agent.POST("/restores/:id", agentHandler.UpdateRestore)

 			// Agent v1（安装脚本探活用），仅 Self 端点
 			v1Agent := api.Group("/v1/agent")
@@ -334,28 +180,7 @@ func NewRouter(deps RouterDependencies) *gin.Engine {
 		}
 	}

-	// 健康检查端点（公开、无认证、低开销）
-	// K8s/Swarm/Nomad 等编排系统使用这些端点做 liveness/readiness 探测。
-	healthHandler := NewHealthHandler(deps.DB, deps.Version)
-	engine.GET("/health", healthHandler.Live)
-	engine.GET("/ready", healthHandler.Ready)
-	// 在 /api 下也暴露一份，方便反向代理按 path 前缀统一路由
-	engine.GET("/api/health", healthHandler.Live)
-	engine.GET("/api/ready", healthHandler.Ready)
-
-	// Prometheus /metrics 端点（公开、无认证；内网/反向代理授权即可）。
-	// 业内通行做法：/metrics 通常由 Prometheus pull 抓取，不走 API Key。
-	if deps.Metrics != nil {
-		engine.GET("/metrics", gin.WrapH(deps.Metrics.Handler()))
-	}
-
-	// 公开安装路由（不走 JWT 中间件）。
-	// 同时注册到 / 和 /api 前缀下：
-	//   - /install/:token        保留历史 URL，兼容旧 nginx 部署
-	//   - /api/install/:token    新 URL，自动走反向代理的 /api/ 转发规则
-	//
-	// Issue #46：用户的 nginx 只转发 /api/，/install/* 被 SPA fallback 到 index.html，
-	// 返回 HTML 被 sh 解释成 "Syntax error"。使用 /api/install/ 可避开此问题。
+	// 公开安装路由（不走 JWT 中间件）
 	if deps.InstallTokenService != nil {
 		gcCtx := deps.Context
 		if gcCtx == nil {
@@ -364,29 +189,11 @@ func NewRouter(deps RouterDependencies) *gin.Engine {
 		installHandler := NewInstallHandler(gcCtx, deps.InstallTokenService, deps.AuditService, deps.MasterExternalURL)
 		engine.GET("/install/:token", installHandler.Script)
 		engine.GET("/install/:token/compose.yml", installHandler.Compose)
-		engine.GET("/api/install/:token", installHandler.Script)
-		engine.GET("/api/install/:token/compose.yml", installHandler.Compose)
 	}

-	// 未匹配路由处理：
-	//   - 找到前端产物目录时，托管 SPA（静态文件 + index.html 回退），
-	//     使后端在无 nginx 反向代理时也能直接提供 Web 控制台（issue #62）；
-	//   - 未找到前端目录时退化为纯 API 服务，统一返回结构化 JSON 404。
-	apiNotFound := func(c *gin.Context) {
+	engine.NoRoute(func(c *gin.Context) {
 		response.Error(c, apperror.New(stdhttp.StatusNotFound, "NOT_FOUND", "接口不存在", errors.New("route not found")))
-	}
-	if webRoot := resolveWebRoot(deps.Config.Server.WebRoot); webRoot != "" {
-		if deps.Logger != nil {
-			deps.Logger.Info("serving web frontend", zap.String("web_root", webRoot))
-		}
-		engine.NoRoute(spaFileServer(webRoot, apiNotFound))
-	} else {
-		if deps.Logger != nil {
-			deps.Logger.Warn("web frontend directory not found; serving API only",
-				zap.String("hint", "set server.web_root in config, or place the built frontend at ./web"))
-		}
-		engine.NoRoute(apiNotFound)
-	}
+	})

 	return engine
 }
--- a/server/internal/http/router_test.go
+++ b/server/internal/http/router_test.go
@@ -16,17 +16,50 @@ import (
 	"backupx/server/internal/repository"
 	"backupx/server/internal/security"
 	"backupx/server/internal/service"
-	"backupx/server/internal/storage/codec"
-
-	"github.com/pquerna/otp/totp"
 )

 func TestSetupLoginAndProfileFlow(t *testing.T) {
-	router, _ := newTestHTTPRouter(t)
+	tempDir := t.TempDir()
+	cfg := config.Config{
+		Server: config.ServerConfig{Host: "127.0.0.1", Port: 8340, Mode: "test"},
+		Database: config.DatabaseConfig{Path: filepath.Join(tempDir, "backupx.db")},
+		Security: config.SecurityConfig{JWTExpire: "24h"},
+		Log: config.LogConfig{Level: "error"},
+	}
+
+	log, err := logger.New(cfg.Log)
+	if err != nil {
+		t.Fatalf("logger.New error: %v", err)
+	}
+	db, err := database.Open(cfg.Database, log)
+	if err != nil {
+		t.Fatalf("database.Open error: %v", err)
+	}
+
+	userRepo := repository.NewUserRepository(db)
+	systemConfigRepo := repository.NewSystemConfigRepository(db)
+	resolved, err := service.ResolveSecurity(context.Background(), cfg.Security, systemConfigRepo)
+	if err != nil {
+		t.Fatalf("ResolveSecurity error: %v", err)
+	}
+	jwtManager := security.NewJWTManager(resolved.JWTSecret, time.Hour)
+	authService := service.NewAuthService(userRepo, systemConfigRepo, jwtManager, security.NewLoginRateLimiter(5, time.Minute))
+	systemService := service.NewSystemService(cfg, "test", time.Now().UTC())
+
+	router := NewRouter(RouterDependencies{
+		Config:           cfg,
+		Version:          "test",
+		Logger:           log,
+		AuthService:      authService,
+		SystemService:    systemService,
+		JWTManager:       jwtManager,
+		UserRepository:   userRepo,
+		SystemConfigRepo: systemConfigRepo,
+	})

 	setupBody, _ := json.Marshal(map[string]string{
-		"username":    "admin",
-		"password":    "password-123",
+		"username": "admin",
+		"password": "password-123",
 		"displayName": "Admin",
 	})
 	setupRequest := httptest.NewRequest(http.MethodPost, "/api/auth/setup", bytes.NewBuffer(setupBody))
@@ -59,143 +92,3 @@ func TestSetupLoginAndProfileFlow(t *testing.T) {
 		t.Fatalf("expected profile 200, got %d", profileRecorder.Code)
 	}
 }
-
-func TestTrustedDeviceCookieSkipsMFA(t *testing.T) {
-	router, authService := newTestHTTPRouter(t)
-	if _, err := authService.Setup(context.Background(), service.SetupInput{
-		Username: "admin", Password: "password-123", DisplayName: "Admin",
-	}); err != nil {
-		t.Fatalf("Setup error: %v", err)
-	}
-	totpSetup, err := authService.PrepareTwoFactor(context.Background(), "1", service.TwoFactorSetupInput{
-		CurrentPassword: "password-123",
-	})
-	if err != nil {
-		t.Fatalf("PrepareTwoFactor error: %v", err)
-	}
-	enableCode, err := totp.GenerateCode(totpSetup.Secret, time.Now().UTC())
-	if err != nil {
-		t.Fatalf("GenerateCode error: %v", err)
-	}
-	if _, err := authService.EnableTwoFactor(context.Background(), "1", service.EnableTwoFactorInput{Code: enableCode}); err != nil {
-		t.Fatalf("EnableTwoFactor error: %v", err)
-	}
-
-	loginCode, err := totp.GenerateCode(totpSetup.Secret, time.Now().UTC())
-	if err != nil {
-		t.Fatalf("GenerateCode login error: %v", err)
-	}
-	loginBody, _ := json.Marshal(map[string]any{
-		"username":          "admin",
-		"password":          "password-123",
-		"twoFactorCode":     loginCode,
-		"rememberDevice":    true,
-		"trustedDeviceName": "test browser",
-	})
-	loginRequest := httptest.NewRequest(http.MethodPost, "/api/auth/login", bytes.NewBuffer(loginBody))
-	loginRequest.Header.Set("Content-Type", "application/json")
-	loginRecorder := httptest.NewRecorder()
-	router.ServeHTTP(loginRecorder, loginRequest)
-
-	if loginRecorder.Code != http.StatusOK {
-		t.Fatalf("expected login 200, got %d: %s", loginRecorder.Code, loginRecorder.Body.String())
-	}
-	trustedCookie := findCookie(loginRecorder.Result().Cookies(), trustedDeviceCookieName)
-	if trustedCookie == nil {
-		t.Fatalf("expected trusted device cookie")
-	}
-	if !trustedCookie.HttpOnly {
-		t.Fatalf("expected trusted device cookie to be HttpOnly")
-	}
-	if trustedCookie.Path != trustedDeviceCookiePath {
-		t.Fatalf("expected trusted device cookie path %q, got %q", trustedDeviceCookiePath, trustedCookie.Path)
-	}
-	var loginResponse struct {
-		Data struct {
-			Token              string                       `json:"token"`
-			TrustedDeviceToken string                       `json:"trustedDeviceToken"`
-			TrustedDevice      *service.TrustedDeviceOutput `json:"trustedDevice"`
-		} `json:"data"`
-	}
-	if err := json.Unmarshal(loginRecorder.Body.Bytes(), &loginResponse); err != nil {
-		t.Fatalf("unmarshal login response: %v", err)
-	}
-	if loginResponse.Data.Token == "" || loginResponse.Data.TrustedDevice == nil {
-		t.Fatalf("expected login token and trusted device metadata")
-	}
-	if loginResponse.Data.TrustedDeviceToken != "" {
-		t.Fatalf("trusted device token should not be exposed in response body")
-	}
-
-	secondBody, _ := json.Marshal(map[string]string{
-		"username": "admin",
-		"password": "password-123",
-	})
-	secondRequest := httptest.NewRequest(http.MethodPost, "/api/auth/login", bytes.NewBuffer(secondBody))
-	secondRequest.Header.Set("Content-Type", "application/json")
-	secondRequest.AddCookie(trustedCookie)
-	secondRecorder := httptest.NewRecorder()
-	router.ServeHTTP(secondRecorder, secondRequest)
-
-	if secondRecorder.Code != http.StatusOK {
-		t.Fatalf("expected trusted device login 200, got %d: %s", secondRecorder.Code, secondRecorder.Body.String())
-	}
-}
-
-func newTestHTTPRouter(t *testing.T) (http.Handler, *service.AuthService) {
-	t.Helper()
-	tempDir := t.TempDir()
-	cfg := config.Config{
-		Server:   config.ServerConfig{Host: "127.0.0.1", Port: 8340, Mode: "test"},
-		Database: config.DatabaseConfig{Path: filepath.Join(tempDir, "backupx.db")},
-		Security: config.SecurityConfig{JWTExpire: "24h"},
-		Log:      config.LogConfig{Level: "error"},
-	}
-
-	log, err := logger.New(cfg.Log)
-	if err != nil {
-		t.Fatalf("logger.New error: %v", err)
-	}
-	db, err := database.Open(cfg.Database, log)
-	if err != nil {
-		t.Fatalf("database.Open error: %v", err)
-	}
-	sqlDB, err := db.DB()
-	if err != nil {
-		t.Fatalf("db.DB error: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = sqlDB.Close()
-	})
-
-	userRepo := repository.NewUserRepository(db)
-	systemConfigRepo := repository.NewSystemConfigRepository(db)
-	resolved, err := service.ResolveSecurity(context.Background(), cfg.Security, systemConfigRepo)
-	if err != nil {
-		t.Fatalf("ResolveSecurity error: %v", err)
-	}
-	jwtManager := security.NewJWTManager(resolved.JWTSecret, time.Hour)
-	authService := service.NewAuthService(userRepo, systemConfigRepo, jwtManager, security.NewLoginRateLimiter(5, time.Minute), codec.NewConfigCipher(resolved.EncryptionKey))
-	systemService := service.NewSystemService(cfg, "test", time.Now().UTC())
-
-	router := NewRouter(RouterDependencies{
-		Config:           cfg,
-		Version:          "test",
-		Logger:           log,
-		AuthService:      authService,
-		SystemService:    systemService,
-		JWTManager:       jwtManager,
-		UserRepository:   userRepo,
-		SystemConfigRepo: systemConfigRepo,
-	})
-	return router, authService
-}
-
-func findCookie(cookies []*http.Cookie, name string) *http.Cookie {
-	for _, cookie := range cookies {
-		if cookie.Name == name {
-			return cookie
-		}
-	}
-	return nil
-}
--- a/server/internal/http/search_handler.go
+++ b/server/internal/http/search_handler.go
@@ -1,28 +0,0 @@
-package http
-
-import (
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// SearchHandler 全局搜索。
-type SearchHandler struct {
-	service *service.SearchService
-}
-
-func NewSearchHandler(s *service.SearchService) *SearchHandler {
-	return &SearchHandler{service: s}
-}
-
-// Search GET /search?q=关键字
-func (h *SearchHandler) Search(c *gin.Context) {
-	query := c.Query("q")
-	result, err := h.service.Search(c.Request.Context(), query)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, result)
-}
--- a/server/internal/http/spa.go
+++ b/server/internal/http/spa.go
@@ -1,86 +0,0 @@
-package http
-
-import (
-	stdhttp "net/http"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-)
-
-// resolveWebRoot 返回前端静态资源目录。优先使用显式配置的路径，
-// 否则按部署惯例依次探测常见位置，返回首个包含 index.html 的目录。
-// 返回空字符串表示未找到前端产物，此时后端退化为纯 API 服务。
-func resolveWebRoot(configured string) string {
-	candidates := []string{
-		configured,
-		"./web/dist",  // 源码树根目录构建产物（优先于 ./web，避免命中前端源码模板）
-		"./web",       // systemd：WorkingDirectory=/opt/backupx → /opt/backupx/web；容器 WORKDIR=/app → /app/web
-		"../web/dist", // 从 server/ 目录运行（make dev-server）
-		"/opt/backupx/web",
-		"/app/web",
-	}
-	for _, dir := range candidates {
-		if strings.TrimSpace(dir) == "" {
-			continue
-		}
-		if hasIndexHTML(dir) {
-			if abs, err := filepath.Abs(dir); err == nil {
-				return abs
-			}
-			return dir
-		}
-	}
-	return ""
-}
-
-func hasIndexHTML(dir string) bool {
-	info, err := os.Stat(filepath.Join(dir, "index.html"))
-	return err == nil && !info.IsDir()
-}
-
-// isReservedBackendPath 判断请求是否命中后端保留前缀（API、探针、安装脚本）。
-// 这些路径即使未匹配到具体路由，也应返回结构化 JSON 404，而不是回退到
-// 前端 index.html —— 否则反向代理/安装脚本会把 HTML 当成接口响应（参考 issue #46）。
-func isReservedBackendPath(p string) bool {
-	switch p {
-	case "/health", "/ready", "/metrics", "/api", "/install":
-		return true
-	}
-	return strings.HasPrefix(p, "/api/") || strings.HasPrefix(p, "/install/")
-}
-
-// spaFileServer 构造 SPA 静态资源处理器，用作 gin 的 NoRoute 回退：
-//   - 后端保留前缀返回 apiNotFound（JSON 404）；
-//   - 其余 GET/HEAD 请求若在 webRoot 内命中真实文件则直接返回该文件；
-//   - 未命中文件的路径回退到 index.html，交由前端路由处理（history 模式刷新）。
-func spaFileServer(webRoot string, apiNotFound gin.HandlerFunc) gin.HandlerFunc {
-	indexPath := filepath.Join(webRoot, "index.html")
-	return func(c *gin.Context) {
-		reqPath := c.Request.URL.Path
-		if isReservedBackendPath(reqPath) {
-			apiNotFound(c)
-			return
-		}
-		if c.Request.Method != stdhttp.MethodGet && c.Request.Method != stdhttp.MethodHead {
-			apiNotFound(c)
-			return
-		}
-
-		// 防目录穿越：以 webRoot 为根清理路径，确保最终目标仍位于 webRoot 内。
-		clean := filepath.Clean("/" + strings.TrimPrefix(reqPath, "/"))
-		target := filepath.Join(webRoot, clean)
-		if rel, err := filepath.Rel(webRoot, target); err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-			apiNotFound(c)
-			return
-		}
-
-		if info, err := os.Stat(target); err == nil && !info.IsDir() {
-			c.File(target)
-			return
-		}
-		// 前端 SPA 路由（/dashboard、/tasks 等）回退到 index.html。
-		c.File(indexPath)
-	}
-}
--- a/server/internal/http/spa_test.go
+++ b/server/internal/http/spa_test.go
@@ -1,175 +0,0 @@
-package http
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/gin-gonic/gin"
-)
-
-func TestResolveWebRoot(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-
-	t.Run("explicit configured dir with index.html", func(t *testing.T) {
-		dir := t.TempDir()
-		writeIndex(t, dir)
-		got := resolveWebRoot(dir)
-		abs, _ := filepath.Abs(dir)
-		if got != abs {
-			t.Fatalf("resolveWebRoot(%q) = %q, want %q", dir, got, abs)
-		}
-	})
-
-	t.Run("configured dir without index.html falls through to none", func(t *testing.T) {
-		dir := t.TempDir() // no index.html, and no conventional ./web in CWD during test
-		if got := resolveWebRoot(dir); got != "" {
-			// 允许 CWD 恰好存在约定目录的环境，但临时目录本身不应被选中。
-			abs, _ := filepath.Abs(dir)
-			if got == abs {
-				t.Fatalf("expected dir without index.html to be skipped, got %q", got)
-			}
-		}
-	})
-
-	t.Run("empty configured uses auto-detect order", func(t *testing.T) {
-		// 切到一个仅含 ./web/dist/index.html 的临时工作目录，验证自动探测。
-		root := t.TempDir()
-		distDir := filepath.Join(root, "web", "dist")
-		if err := os.MkdirAll(distDir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		writeIndex(t, distDir)
-
-		restore := chdir(t, root)
-		defer restore()
-
-		// 以 chdir 之后的实际工作目录为基准计算期望值，避免 macOS 上
-		// /var → /private/var 符号链接导致字符串不一致。
-		wd, err := os.Getwd()
-		if err != nil {
-			t.Fatal(err)
-		}
-		want := filepath.Join(wd, "web", "dist")
-
-		got := resolveWebRoot("")
-		if got != want {
-			t.Fatalf("auto-detect = %q, want %q", got, want)
-		}
-	})
-}
-
-func TestIsReservedBackendPath(t *testing.T) {
-	reserved := []string{"/health", "/ready", "/metrics", "/api", "/install", "/api/", "/api/system/info", "/install/abc", "/install/abc/compose.yml"}
-	for _, p := range reserved {
-		if !isReservedBackendPath(p) {
-			t.Errorf("isReservedBackendPath(%q) = false, want true", p)
-		}
-	}
-	notReserved := []string{"/", "/dashboard", "/assets/app.js", "/installer", "/apidocs", "/favicon.ico"}
-	for _, p := range notReserved {
-		if isReservedBackendPath(p) {
-			t.Errorf("isReservedBackendPath(%q) = true, want false", p)
-		}
-	}
-}
-
-func TestSpaFileServer(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	webRoot := t.TempDir()
-	writeIndexContent(t, webRoot, "<!doctype html><title>BackupX</title>")
-	assetsDir := filepath.Join(webRoot, "assets")
-	if err := os.MkdirAll(assetsDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(assetsDir, "app.js"), []byte("console.log(1)"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	apiNotFoundHit := false
-	apiNotFound := func(c *gin.Context) {
-		apiNotFoundHit = true
-		c.JSON(http.StatusNotFound, gin.H{"code": "NOT_FOUND"})
-	}
-
-	engine := gin.New()
-	engine.NoRoute(spaFileServer(webRoot, apiNotFound))
-
-	cases := []struct {
-		name       string
-		method     string
-		path       string
-		wantStatus int
-		wantBody   string // 子串；为空表示不校验
-		wantAPI404 bool
-	}{
-		{name: "root serves index", method: http.MethodGet, path: "/", wantStatus: 200, wantBody: "BackupX"},
-		{name: "spa route falls back to index", method: http.MethodGet, path: "/dashboard", wantStatus: 200, wantBody: "BackupX"},
-		{name: "real asset served", method: http.MethodGet, path: "/assets/app.js", wantStatus: 200, wantBody: "console.log"},
-		{name: "api path returns json 404", method: http.MethodGet, path: "/api/garbage", wantStatus: 404, wantAPI404: true},
-		{name: "health returns json 404 via reserved", method: http.MethodGet, path: "/health", wantStatus: 404, wantAPI404: true},
-		{name: "non-GET on spa path is api 404", method: http.MethodPost, path: "/dashboard", wantStatus: 404, wantAPI404: true},
-		{name: "directory falls back to index", method: http.MethodGet, path: "/assets/", wantStatus: 200, wantBody: "BackupX"},
-		// 含 ".." 的请求路径被 net/http 在文件服务层直接拒绝（400 invalid URL path），
-		// 绝不会泄露 webRoot 之外的文件；这是在 filepath.Rel 校验之上的纵深防御。
-		{name: "traversal rejected, never serves passwd", method: http.MethodGet, path: "/../../etc/passwd", wantStatus: 400, wantBody: "invalid URL path"},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			apiNotFoundHit = false
-			req := httptest.NewRequest(tc.method, tc.path, nil)
-			rec := httptest.NewRecorder()
-			engine.ServeHTTP(rec, req)
-
-			if rec.Code != tc.wantStatus {
-				t.Fatalf("status = %d, want %d (body=%q)", rec.Code, tc.wantStatus, rec.Body.String())
-			}
-			if tc.wantBody != "" && !contains(rec.Body.String(), tc.wantBody) {
-				t.Fatalf("body %q does not contain %q", rec.Body.String(), tc.wantBody)
-			}
-			if tc.wantAPI404 != apiNotFoundHit {
-				t.Fatalf("apiNotFoundHit = %v, want %v", apiNotFoundHit, tc.wantAPI404)
-			}
-		})
-	}
-}
-
-func writeIndex(t *testing.T, dir string) {
-	t.Helper()
-	writeIndexContent(t, dir, "<!doctype html><title>BackupX</title>")
-}
-
-func writeIndexContent(t *testing.T, dir, content string) {
-	t.Helper()
-	if err := os.WriteFile(filepath.Join(dir, "index.html"), []byte(content), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func chdir(t *testing.T, dir string) func() {
-	t.Helper()
-	orig, err := os.Getwd()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Chdir(dir); err != nil {
-		t.Fatal(err)
-	}
-	return func() { _ = os.Chdir(orig) }
-}
-
-func contains(s, sub string) bool {
-	return len(sub) == 0 || (len(s) >= len(sub) && indexOf(s, sub) >= 0)
-}
-
-func indexOf(s, sub string) int {
-	for i := 0; i+len(sub) <= len(s); i++ {
-		if s[i:i+len(sub)] == sub {
-			return i
-		}
-	}
-	return -1
-}
--- a/server/internal/http/storage_target_handler.go
+++ b/server/internal/http/storage_target_handler.go
@@ -199,7 +199,7 @@ func (h *StorageTargetHandler) GoogleDriveProfile(c *gin.Context) {

 func parseUintParam(c *gin.Context, key string) (uint, bool) {
 	value := strings.TrimSpace(c.Param(key))
-	parsed, err := strconv.ParseUint(value, 10, 0)
+	parsed, err := strconv.ParseUint(value, 10, 64)
 	if err != nil {
 		response.Error(c, apperror.BadRequest("INVALID_ID", fmt.Sprintf("参数 %s 不合法", key), err))
 		return 0, false
--- a/server/internal/http/task_export_handler.go
+++ b/server/internal/http/task_export_handler.go
@@ -1,101 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	stdhttp "net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// TaskExportHandler 提供任务配置 JSON 导入/导出。
-type TaskExportHandler struct {
-	service      *service.TaskExportService
-	auditService *service.AuditService
-}
-
-func NewTaskExportHandler(s *service.TaskExportService, audit *service.AuditService) *TaskExportHandler {
-	return &TaskExportHandler{service: s, auditService: audit}
-}
-
-// Export GET /api/backup/tasks/export?ids=1,2,3
-// 无 ids 参数时导出全部任务。返回 application/json + Content-Disposition。
-func (h *TaskExportHandler) Export(c *gin.Context) {
-	var taskIDs []uint
-	if v := strings.TrimSpace(c.Query("ids")); v != "" {
-		for _, part := range strings.Split(v, ",") {
-			if id, err := strconv.ParseUint(strings.TrimSpace(part), 10, 32); err == nil {
-				taskIDs = append(taskIDs, uint(id))
-			}
-		}
-	}
-	payload, err := h.service.Export(c.Request.Context(), taskIDs)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	data, err := json.MarshalIndent(payload, "", "  ")
-	if err != nil {
-		response.Error(c, apperror.Internal("TASK_EXPORT_MARSHAL_FAILED", "无法序列化导出内容", err))
-		return
-	}
-	filename := fmt.Sprintf("backupx-tasks-%s.json", time.Now().UTC().Format("20060102-150405"))
-	c.Header("Content-Type", "application/json; charset=utf-8")
-	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
-	_, _ = c.Writer.Write(data)
-	recordAudit(c, h.auditService, "backup_task", "export", "backup_task", "", "",
-		fmt.Sprintf("导出 %d 个任务的配置为 JSON", payload.TaskCount))
-}
-
-// Import POST /api/backup/tasks/import
-// Body: ExportPayload JSON。返回每个任务的创建/跳过结果。
-func (h *TaskExportHandler) Import(c *gin.Context) {
-	body, err := io.ReadAll(c.Request.Body)
-	if err != nil {
-		response.Error(c, apperror.BadRequest("TASK_IMPORT_INVALID", "无法读取请求体", err))
-		return
-	}
-	if len(body) == 0 {
-		response.Error(c, apperror.BadRequest("TASK_IMPORT_INVALID", "请求体为空", nil))
-		return
-	}
-	if len(body) > 1024*1024 { // 1MB 上限
-		c.Writer.WriteHeader(stdhttp.StatusRequestEntityTooLarge)
-		response.Error(c, apperror.BadRequest("TASK_IMPORT_TOO_LARGE", "导入文件过大（上限 1MB）", nil))
-		return
-	}
-	var payload service.ExportPayload
-	if err := json.Unmarshal(body, &payload); err != nil {
-		response.Error(c, apperror.BadRequest("TASK_IMPORT_INVALID", "JSON 格式不合法", err))
-		return
-	}
-	if len(payload.Tasks) == 0 {
-		response.Error(c, apperror.BadRequest("TASK_IMPORT_INVALID", "文件中未包含任何任务", nil))
-		return
-	}
-	results, err := h.service.Import(c.Request.Context(), payload)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	succ := 0
-	skipped := 0
-	for _, r := range results {
-		if r.Success && !r.Skipped {
-			succ++
-		} else if r.Skipped {
-			skipped++
-		}
-	}
-	recordAudit(c, h.auditService, "backup_task", "import", "backup_task", "", "",
-		fmt.Sprintf("从 JSON 导入任务：创建 %d / 跳过 %d / 失败 %d", succ, skipped, len(results)-succ-skipped))
-	response.Success(c, results)
-}
--- a/server/internal/http/task_template_handler.go
+++ b/server/internal/http/task_template_handler.go
@@ -1,125 +0,0 @@
-package http
-
-import (
-	"fmt"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-type TaskTemplateHandler struct {
-	service      *service.TaskTemplateService
-	auditService *service.AuditService
-}
-
-func NewTaskTemplateHandler(templateService *service.TaskTemplateService, auditService *service.AuditService) *TaskTemplateHandler {
-	return &TaskTemplateHandler{service: templateService, auditService: auditService}
-}
-
-func (h *TaskTemplateHandler) List(c *gin.Context) {
-	items, err := h.service.List(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *TaskTemplateHandler) Get(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	item, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, item)
-}
-
-func (h *TaskTemplateHandler) Create(c *gin.Context) {
-	var input service.TaskTemplateUpsertInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("TASK_TEMPLATE_INVALID", "模板参数不合法", err))
-		return
-	}
-	creator := ""
-	if v, ok := c.Get(contextUsernameKey); ok {
-		if s, ok := v.(string); ok {
-			creator = s
-		}
-	}
-	item, err := h.service.Create(c.Request.Context(), creator, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "task_template", "create", "task_template", fmt.Sprintf("%d", item.ID), item.Name,
-		fmt.Sprintf("创建任务模板: %s (类型: %s)", item.Name, item.TaskType))
-	response.Success(c, item)
-}
-
-func (h *TaskTemplateHandler) Update(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input service.TaskTemplateUpsertInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("TASK_TEMPLATE_INVALID", "模板参数不合法", err))
-		return
-	}
-	item, err := h.service.Update(c.Request.Context(), id, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "task_template", "update", "task_template", fmt.Sprintf("%d", item.ID), item.Name,
-		fmt.Sprintf("更新任务模板: %s", item.Name))
-	response.Success(c, item)
-}
-
-func (h *TaskTemplateHandler) Delete(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	if err := h.service.Delete(c.Request.Context(), id); err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "task_template", "delete", "task_template", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("删除任务模板 (ID: %d)", id))
-	response.Success(c, gin.H{"deleted": true})
-}
-
-// Apply 一键批量创建任务。Body: {variables: [{name, sourcePath, ...}, ...]}
-func (h *TaskTemplateHandler) Apply(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input service.TaskTemplateApplyInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("TASK_TEMPLATE_INVALID", "应用参数不合法", err))
-		return
-	}
-	results, err := h.service.Apply(c.Request.Context(), id, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	successCount := 0
-	for _, r := range results {
-		if r.Success {
-			successCount++
-		}
-	}
-	recordAudit(c, h.auditService, "task_template", "apply", "task_template", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("应用模板批量创建任务（成功 %d/%d）", successCount, len(results)))
-	response.Success(c, results)
-}
--- a/server/internal/http/user_handler.go
+++ b/server/internal/http/user_handler.go
@@ -1,95 +0,0 @@
-package http
-
-import (
-	"fmt"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// UserHandler 管理账号（仅 admin 可访问）。
-type UserHandler struct {
-	service      *service.UserService
-	auditService *service.AuditService
-}
-
-func NewUserHandler(userService *service.UserService, auditService *service.AuditService) *UserHandler {
-	return &UserHandler{service: userService, auditService: auditService}
-}
-
-func (h *UserHandler) List(c *gin.Context) {
-	items, err := h.service.List(c.Request.Context())
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *UserHandler) Create(c *gin.Context) {
-	var input service.UserUpsertInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("USER_INVALID", "用户参数不合法", err))
-		return
-	}
-	item, err := h.service.Create(c.Request.Context(), input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "user", "create", "user", fmt.Sprintf("%d", item.ID), item.Username,
-		fmt.Sprintf("创建用户 %s (角色: %s)", item.Username, item.Role))
-	response.Success(c, item)
-}
-
-func (h *UserHandler) Update(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input service.UserUpsertInput
-	if err := c.ShouldBindJSON(&input); err != nil {
-		response.Error(c, apperror.BadRequest("USER_INVALID", "用户参数不合法", err))
-		return
-	}
-	item, err := h.service.Update(c.Request.Context(), id, input)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "user", "update", "user", fmt.Sprintf("%d", id), item.Username,
-		fmt.Sprintf("更新用户 %s (角色: %s, 停用: %v)", item.Username, item.Role, item.Disabled))
-	response.Success(c, item)
-}
-
-func (h *UserHandler) Delete(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	if err := h.service.Delete(c.Request.Context(), id); err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "user", "delete", "user", fmt.Sprintf("%d", id), "",
-		fmt.Sprintf("删除用户 (ID: %d)", id))
-	response.Success(c, gin.H{"deleted": true})
-}
-
-func (h *UserHandler) ResetTwoFactor(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	item, err := h.service.ResetTwoFactor(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "user", "reset_two_factor", "user", fmt.Sprintf("%d", id), item.Username,
-		fmt.Sprintf("重置用户 %s 的 MFA", item.Username))
-	response.Success(c, item)
-}
--- a/server/internal/http/verification_handler.go
+++ b/server/internal/http/verification_handler.go
@@ -1,207 +0,0 @@
-package http
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"strconv"
-	"strings"
-	"time"
-
-	"backupx/server/internal/apperror"
-	"backupx/server/internal/backup"
-	"backupx/server/internal/service"
-	"backupx/server/pkg/response"
-
-	"github.com/gin-gonic/gin"
-)
-
-// VerificationHandler 提供验证记录列表/详情/SSE，以及手动触发入口。
-type VerificationHandler struct {
-	service      *service.VerificationService
-	auditService *service.AuditService
-}
-
-func NewVerificationHandler(verifyService *service.VerificationService, auditService *service.AuditService) *VerificationHandler {
-	return &VerificationHandler{service: verifyService, auditService: auditService}
-}
-
-// TriggerByTask 接收任务级手动触发。使用最新成功备份为源。
-func (h *VerificationHandler) TriggerByTask(c *gin.Context) {
-	taskID, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input struct {
-		Mode string `json:"mode"`
-	}
-	_ = c.ShouldBindJSON(&input)
-	triggeredBy := ""
-	if subject, exists := c.Get(contextUserSubjectKey); exists {
-		triggeredBy = strings.TrimSpace(fmt.Sprintf("%v", subject))
-	}
-	if triggeredBy == "" {
-		triggeredBy = "manual"
-	}
-	detail, err := h.service.StartByTask(c.Request.Context(), taskID, input.Mode, triggeredBy)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "backup_verify", "manual_run", "backup_task", fmt.Sprintf("%d", taskID), "",
-		fmt.Sprintf("手动触发验证（任务 ID: %d, 验证记录 ID: %d, 模式: %s）", taskID, detail.ID, detail.Mode))
-	response.Success(c, detail)
-}
-
-// TriggerByRecord 基于指定备份记录触发验证（允许验证历史备份）。
-func (h *VerificationHandler) TriggerByRecord(c *gin.Context) {
-	recordID, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	var input struct {
-		Mode string `json:"mode"`
-	}
-	_ = c.ShouldBindJSON(&input)
-	triggeredBy := ""
-	if subject, exists := c.Get(contextUserSubjectKey); exists {
-		triggeredBy = strings.TrimSpace(fmt.Sprintf("%v", subject))
-	}
-	if triggeredBy == "" {
-		triggeredBy = "manual"
-	}
-	detail, err := h.service.Start(c.Request.Context(), recordID, input.Mode, triggeredBy)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	recordAudit(c, h.auditService, "backup_verify", "manual_run", "backup_record", fmt.Sprintf("%d", recordID), "",
-		fmt.Sprintf("手动触发验证（备份记录 ID: %d, 验证记录 ID: %d, 模式: %s）", recordID, detail.ID, detail.Mode))
-	response.Success(c, detail)
-}
-
-func (h *VerificationHandler) List(c *gin.Context) {
-	filter, err := buildVerifyFilter(c)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	items, err := h.service.List(c.Request.Context(), filter)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, items)
-}
-
-func (h *VerificationHandler) Get(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	item, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	response.Success(c, item)
-}
-
-func (h *VerificationHandler) StreamLogs(c *gin.Context) {
-	id, ok := parseUintParam(c, "id")
-	if !ok {
-		return
-	}
-	detail, err := h.service.Get(c.Request.Context(), id)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	events := detail.LogEvents
-	completed := detail.Status != "running"
-	channel, cancel, err := h.service.SubscribeLogs(c.Request.Context(), id, 64)
-	if err != nil {
-		response.Error(c, err)
-		return
-	}
-	defer cancel()
-	c.Writer.Header().Set("Content-Type", "text/event-stream")
-	c.Writer.Header().Set("Cache-Control", "no-cache")
-	c.Writer.Header().Set("Connection", "keep-alive")
-	flusher, ok := c.Writer.(interface{ Flush() })
-	if !ok {
-		response.Error(c, apperror.Internal("VERIFY_STREAM_UNSUPPORTED", "当前连接不支持日志流", nil))
-		return
-	}
-	for _, event := range events {
-		if err := writeVerifySSEEvent(c.Writer, event); err != nil {
-			return
-		}
-		flusher.Flush()
-	}
-	if completed {
-		return
-	}
-	for {
-		select {
-		case <-c.Request.Context().Done():
-			return
-		case event, ok := <-channel:
-			if !ok {
-				return
-			}
-			if err := writeVerifySSEEvent(c.Writer, event); err != nil {
-				return
-			}
-			flusher.Flush()
-			if event.Completed {
-				return
-			}
-		}
-	}
-}
-
-func buildVerifyFilter(c *gin.Context) (service.VerificationRecordListInput, error) {
-	var filter service.VerificationRecordListInput
-	if value := strings.TrimSpace(c.Query("taskId")); value != "" {
-		parsed, err := strconv.ParseUint(value, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("VERIFY_RECORD_FILTER_INVALID", "taskId 不合法", err)
-		}
-		v := uint(parsed)
-		filter.TaskID = &v
-	}
-	if value := strings.TrimSpace(c.Query("backupRecordId")); value != "" {
-		parsed, err := strconv.ParseUint(value, 10, 32)
-		if err != nil {
-			return filter, apperror.BadRequest("VERIFY_RECORD_FILTER_INVALID", "backupRecordId 不合法", err)
-		}
-		v := uint(parsed)
-		filter.BackupRecordID = &v
-	}
-	filter.Status = strings.TrimSpace(c.Query("status"))
-	if dateFrom := strings.TrimSpace(c.Query("dateFrom")); dateFrom != "" {
-		parsed, err := time.Parse(time.RFC3339, dateFrom)
-		if err != nil {
-			return filter, apperror.BadRequest("VERIFY_RECORD_FILTER_INVALID", "dateFrom 必须为 RFC3339 时间格式", err)
-		}
-		filter.DateFrom = &parsed
-	}
-	if dateTo := strings.TrimSpace(c.Query("dateTo")); dateTo != "" {
-		parsed, err := time.Parse(time.RFC3339, dateTo)
-		if err != nil {
-			return filter, apperror.BadRequest("VERIFY_RECORD_FILTER_INVALID", "dateTo 必须为 RFC3339 时间格式", err)
-		}
-		filter.DateTo = &parsed
-	}
-	return filter, nil
-}
-
-func writeVerifySSEEvent(writer io.Writer, event backup.LogEvent) error {
-	payload, err := json.Marshal(event)
-	if err != nil {
-		return err
-	}
-	_, err = fmt.Fprintf(writer, "event: log\ndata: %s\n\n", payload)
-	return err
-}
--- a/server/internal/installscript/deploy_install_test.go
+++ b/server/internal/installscript/deploy_install_test.go
@@ -1,41 +0,0 @@
-package installscript
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestDeployInstallScriptSyntax(t *testing.T) {
-	scriptPath := filepath.Join("..", "..", "..", "deploy", "install.sh")
-	cmd := exec.Command("sh", "-n", scriptPath)
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("install.sh syntax invalid: %v\n%s", err, output)
-	}
-}
-
-func TestDeployInstallScriptSupportsReleasePackageLayout(t *testing.T) {
-	scriptPath := filepath.Join("..", "..", "..", "deploy", "install.sh")
-	data, err := os.ReadFile(scriptPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	script := string(data)
-	for _, want := range []string{
-		`SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)`,
-		`if [ -f "$SCRIPT_DIR/backupx" ] && [ -d "$SCRIPT_DIR/web" ]; then`,
-		`BIN_SOURCE="${BIN_SOURCE:-$SCRIPT_DIR/backupx}"`,
-		`WEB_SOURCE="${WEB_SOURCE:-$SCRIPT_DIR/web}"`,
-		`CONFIG_TEMPLATE="${CONFIG_TEMPLATE:-$SCRIPT_DIR/config.example.yaml}"`,
-		`发布包安装请确认当前目录包含 ./backupx、./web 和 ./install.sh。`,
-		`cat > "/etc/systemd/system/$SERVICE_NAME.service" <<UNIT`,
-		`if [ -d "/etc/nginx/conf.d" ] && [ -f "$NGINX_SOURCE" ]; then`,
-	} {
-		if !strings.Contains(script, want) {
-			t.Fatalf("install.sh missing %q", want)
-		}
-	}
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Awuqing	34a9bc82be	修复: 前端审查发现的 3 项问题 1. masterVersion null 态（NodesPage + Wizard + Step2）原 'latest' 默认值会生成 releases/download/latest/... 404 URL。改为 null（拉取中）/ 空串（失败）两态： - 拉取成功：Select 显示 Master 版本 - 拉取失败：Input 要求用户手动输入版本号 - handleGenerate 前校验 agentVersion 非空 2. 批量创建 N+1 串行请求 → Promise.all 并发 + 进度条原 for 循环逐个 await createInstallToken，50 节点 N 次串行延迟。改为 Promise.all 并发，用 batchProgress state 驱动 Arco Progress 显示 "已生成 X / N 个令牌"，同时 mountedRef 保护 unmount 后不更新 state。 3. 批次内重复节点名前端预提示 spec §6.2 要求"前端去重"，此前依赖后端报错。 handleGenerate 前扫描 parseBatchNames 检测批次内重复并 Message.warning。	2026-04-19 17:17:08 +08:00
Awuqing	5c896bb96c	修复: 后端审查发现的 5 项问题根据 Spec + Code Quality 双审查修复： 1. BatchCreate 事务保护（node_service.go/node_repository.go）原循环 Create 在 DB 约束失败时会残留半截数据。改为预先构造所有 Node 再走 repo.BatchCreate 单一事务，任一失败整体回滚。 2. Peek 语义与 Consume 对齐（agent_install_token_repository.go） FindByToken 无条件返回任意记录，导致已消费/已过期的僵尸 token 可通过 compose 端点的 mode 检查但必然 Consume 失败，出现 410 假错。新增 FindValidByToken，Peek 改用之。 3. MasterURL / AgentToken / AgentVersion 渲染前校验（installscript/renderer.go）防止 YAML 注入（换行/引号逃逸 compose 配置）、shell 注入（$(...)）、非法字符。加 TestRenderScriptRejects* 系列测试覆盖。 4. ipLimiter 无界增长修复（install_handler.go）新增 gc 方法 + startGC 后台协程，每 window 周期清理过期 IP 条目。 RouterDependencies.Context 控制生命周期；app 传入 ctx，测试 t.Cleanup 取消。 5. CreateInstallToken 的 CreatedByID 从 JWT subject 解析（node_handler.go）原硬编码 0 导致审计不可追溯。新增 resolveCurrentUserID helper，借助 UserRepository 把 JWT subject（用户名）→ user.ID；失败退回 0。	2026-04-19 17:14:17 +08:00
Awuqing	e28f2d3454	文档: 更新多节点文档，描述一键部署向导（中英双份） - Walkthrough 章节改写为三步向导流程 - 新增 Token 轮换说明、批量部署说明 - 对应 Issue #43 功能	2026-04-19 16:50:30 +08:00
Awuqing	5b03485f15	功能: NodesPage 集成一键部署 Wizard 与操作列改造	2026-04-19 16:48:54 +08:00
Awuqing	42b7e2013a	功能: AgentInstallWizard 主容器整合三步向导	2026-04-19 16:47:03 +08:00
Awuqing	275a466e6a	功能: Wizard Step3 命令预览 + BatchCommandTable 批量表	2026-04-19 16:44:46 +08:00
Awuqing	ae71d952b1	功能: Wizard Step2 部署参数表单	2026-04-19 16:42:32 +08:00
Awuqing	46de6cf03a	功能: Wizard Step1 节点信息输入组件	2026-04-19 16:41:18 +08:00
Awuqing	37440e583d	功能: 前端新增一键部署 API 类型与函数	2026-04-19 16:40:17 +08:00
Awuqing	3487dfcee8	测试: 一键部署端到端流程集成测试	2026-04-19 16:38:26 +08:00
Awuqing	60fda5a5e4	功能: 注册一键部署新路由并 wire InstallTokenService	2026-04-19 16:34:58 +08:00
Awuqing	65ee70f6d3	功能: AgentHandler 新增 Self 端点	2026-04-19 16:32:45 +08:00
Awuqing	c0db0e0eac	功能: NodeHandler 新增批量创建/轮换 Token/install-token/预览端点	2026-04-19 16:31:52 +08:00
Awuqing	e1a70624bc	功能: 新增公开 install_handler 渲染安装脚本与 compose.yml	2026-04-19 16:29:45 +08:00
Awuqing	665a88a0a7	功能: AgentService 新增 SelfStatus 用于安装脚本探活	2026-04-19 16:27:43 +08:00
Awuqing	8d52be23b0	功能: NodeService 新增 BatchCreate 与 RotateToken	2026-04-19 16:26:41 +08:00
Awuqing	b7ace8e3a5	功能: 新增 InstallTokenService 含输入校验、限流、GC	2026-04-19 16:24:10 +08:00
Awuqing	f53fa661c8	重构: 移除 deploy/ 下的 agent 模板副本 Go embed 不能跨模块根引用，server/internal/installscript/templates/ 已是唯一真源；deploy/*.tmpl 属于死代码，避免未来维护双份。	2026-04-19 16:20:59 +08:00
Awuqing	0d26bc3d91	功能: 新增 installscript 包，渲染 systemd/docker/foreground 安装脚本	2026-04-19 16:19:52 +08:00
Awuqing	c8b5095b2f	功能: 新增 AgentInstallToken 仓储与原子消费语义	2026-04-19 16:16:46 +08:00
Awuqing	fb043627bb	功能: NodeRepository.FindByToken 支持 prev_token 24h 过渡	2026-04-19 16:15:03 +08:00
Awuqing	65cbbea3b6	功能: 新增 AgentInstallToken 模型与 Node token 轮换字段	2026-04-19 16:12:59 +08:00