refactor: 收口 V3 分层架构与插件兼容边界

app/factory.py

@@ -8,7 +8,15 @@ from fastapi.responses import JSONResponse
 from starlette.exceptions import HTTPException
 
 from app.api.response import ResponseAPIRoute
-from app.application.plugins import register_api_app
+from app.adapters.web.plugin.routes import FastAPIDynamicRouteRegistry
+from app.application.plugins import configure_plugin_routes
+from app.adapters.web.security.access import (
+    configure_token_codec,
+    verify_apikey,
+    verify_token,
+)
+from app.application.security.token import create_access_token, decode_access_token
+from app.runtime.extensions.plugin_manager import PluginManager
 from app.runtime.config import settings
 from app.runtime.localization import LocaleHelper
 from app.runtime.log import logger
@@ -325,9 +333,26 @@ def create_app() -> FastAPI:
     return _app
 
 
+# HTTP 适配器只持有令牌编解码端口，具体实现由组合根连接。
+configure_token_codec(create_access_token, decode_access_token)
+
 # 创建 FastAPI 应用实例
 app = create_app()
 
 # 向 application 层插件路由服务注入应用实例，插件 API 的动态注册/移除
 # 统一经服务完成，避免 api.endpoints 反向依赖本模块。
-register_api_app(app)
+configure_plugin_routes(FastAPIDynamicRouteRegistry(
+    app=app,
+    plugin_ids=lambda: PluginManager().get_running_plugin_ids(),
+    plugin_apis=lambda plugin_id: PluginManager().get_plugin_apis(plugin_id),
+    verify_token=verify_token,
+    verify_apikey=verify_apikey,
+    prefix=f"{settings.API_V1_STR}/plugin",
+    protected_routes={
+        f"{settings.API_V1_STR}/openapi.json",
+        "/docs",
+        "/docs/oauth2-redirect",
+        "/redoc",
+    },
+    log=logger,
+))