refactor: migrate auth runtime configuration

app/application/security/auth.py

@@ -7,7 +7,7 @@ from typing import Any, Optional, Protocol
 from app.schemas.token import Token as _SchemaToken
 from app.schemas.token import TokenPayload as _SchemaTokenPayload
 from app.application.security.token import create_access_token
-from app.runtime.config import settings
+from app.application.configuration import get_api_runtime_config_snapshot, get_chain_runtime_config_snapshot
 from app.application.site.sites import SitesHelper  # pylint: disable=import-error,no-name-in-module
 from app.schemas.types import SystemConfigKey
 from app.foundation.singleton import Singleton
@@ -173,7 +173,7 @@ class AuthService:
 
     def build_superuser_token_payload(self) -> _SchemaTokenPayload:
         """从持久化用户和站点认证状态构造超级用户令牌载荷。"""
-        user = self._users.get_by_name(settings.SUPERUSER)
+        user = self._users.get_by_name(get_chain_runtime_config_snapshot().superuser)
         if not user or not user.is_superuser:
             raise PermissionError("用户权限不足")
         return _SchemaTokenPayload(
@@ -187,16 +187,17 @@ class AuthService:
     def build_token_response(self, user: AuthUser) -> _SchemaToken:
         """使用统一逻辑构造登录 Token 响应。"""
         level = SitesHelper().auth_level
+        config = get_api_runtime_config_snapshot()
         show_wizard = (
             not self._config.get(SystemConfigKey.SetupWizardState)
-            and not settings.ADVANCED_MODE
+            and not config.advanced_mode
         )
         return _SchemaToken(
             access_token=create_access_token(
                 userid=user.id,
                 username=user.name,
                 super_user=user.is_superuser,
-                expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES),
+                expires_delta=timedelta(minutes=config.access_token_expire_minutes),
                 level=level,
             ),
             token_type="bearer",

docs/refactor/backend-architecture-next-stage.md

@@ -983,6 +983,8 @@ Outbox adapter、DB 装饰器、Base 与 UoW，strict 清单扩大到 37 个源
 清理服务与 Chain 专项测试通过。
 Passkey 的 APP_DOMAIN、NGINX_PORT 和用户验证要求也已接入 API 配置快照，配置债务降至 131 个文件；
 MFA/Passkey 专项测试与架构门禁通过，密钥类配置仍保留在安全端口范围内。
+认证服务的超级用户、向导开关和访问令牌过期时间也改用配置快照，债务降至 130 个文件；
+鉴权与 MFA 专项测试通过。
 `DownloadChain.download_single` 的下载成功结算已提取为独立阶段，入口从 255 行降至 167 行；
 历史、文件明细、durable intent、post-commit 通知和旧测试 fallback 语义保持，下载专项测试通过。
 

tests/fixtures/architecture/configuration-debt-baseline.json

@@ -9,7 +9,7 @@
     "root": "app"
   },
   "settings_imports": {
-    "count": 131,
+    "count": 130,
     "files": [
       "app/adapters/cache/backends.py",
       "app/adapters/cache/redis.py",
@@ -47,7 +47,6 @@
       "app/agent/tools/impl/send_voice_message.py",
       "app/agent/tools/impl/update_agent_task.py",
       "app/agent/tools/impl/update_system_settings.py",
-      "app/application/security/auth.py",
       "app/application/security/token.py",
       "app/application/security/url.py",
       "app/cli.py",

tests/fixtures/architecture/dependency-baseline.json

@@ -13,8 +13,8 @@
     "runtime_to_db": [],
     "workflow_to_db": []
   },
-  "edge_count": 6399,
-  "edge_sha256": "f3e4e76578ddfc1ac0717f9d0c2fc9a95c4c659e00c3cc25894304c69ae892fa",
+  "edge_count": 6398,
+  "edge_sha256": "a830340a7981510b25b33e65c1a2d11a190028bfa616676fe935bc983a8a33cd",
   "edges": [
     "app -> app.runtime",
     "app -> app.runtime.compat",
@@ -2667,13 +2667,12 @@
     "app.application.search.state -> app.schemas.media",
     "app.application.search.state -> app.schemas.types",
     "app.application.security.auth -> app.application",
+    "app.application.security.auth -> app.application.configuration",
     "app.application.security.auth -> app.application.security",
     "app.application.security.auth -> app.application.security.token",
     "app.application.security.auth -> app.application.site",
     "app.application.security.auth -> app.foundation",
     "app.application.security.auth -> app.foundation.singleton",
-    "app.application.security.auth -> app.runtime",
-    "app.application.security.auth -> app.runtime.config",
     "app.application.security.auth -> app.schemas",
     "app.application.security.auth -> app.schemas.token",
     "app.application.security.auth -> app.schemas.types",