M0-M4: 推倒重来基线(基建+用户/密钥/核心代理+前端+管理后台+三协议互转)

- 后端 Go+Gin+GORM: 配置(OT_ env)/SQLite/Postgres 双驱动、用户体系(argon2id+JWT access/refresh)、
  API Key(sk- 48位, 仅存 SHA-256 哈希)
- 代理网关: /v1/chat/completions、/v1/responses、/v1/messages、/v1/models;错误按客户端协议返回
- 三协议互转(convert 包): Chat↔Messages↔Responses 请求/响应 + 流式 SSE 逐事件转换(直通优先)
- 用量计费: 异步批量记账、余额扣减、balance_logs、usage_daily 日聚合
- 管理 API: 用户/渠道 CRUD+测试+模型导入/模型定价+绑定/统计/系统配置
- 前端 Vue3+TS+Tailwind(taste-skill 设计 tokens): Landing/登录注册/控制台/管理后台,
  自建组件+Phosphor 图标+自建 SVG 趋势图, 已过 web-design-guidelines 复查
- mock 上游: OpenAI+Anthropic 双协议模拟(含流式)

Co-Authored-By: Claude <noreply@anthropic.com>

server/internal/pkg/jwt/jwt_test.go

@@ -5,37 +5,41 @@ import (
 	"time"
 )
 
-func TestSignParse(t *testing.T) {
+func TestSignParseAccess(t *testing.T) {
 	m := NewManager("test-secret", "openteam", time.Hour, 24*time.Hour)
 	tok, exp, err := m.Sign(42, "alice", "admin", "access")
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("Sign: %v", err)
 	}
-	if time.Until(exp) < 50*time.Minute {
-		t.Fatal("expiry too short")
+	if exp.Before(time.Now()) {
+		t.Fatal("expires in the past")
 	}
 	claims, err := m.Parse(tok)
 	if err != nil {
-		t.Fatal(err)
+		t.Fatalf("Parse: %v", err)
 	}
-	if claims.UserID != 42 || claims.Username != "alice" || claims.Role != "admin" || claims.Subject != "access" {
+	if claims.UserID != 42 || claims.Username != "alice" || claims.Role != "admin" {
 		t.Fatalf("claims mismatch: %+v", claims)
 	}
+	if claims.Subject != "access" {
+		t.Fatalf("subject mismatch: %s", claims.Subject)
+	}
+}
+
+func TestParseRejectsBadToken(t *testing.T) {
+	m := NewManager("test-secret", "openteam", time.Hour, 24*time.Hour)
+	if _, err := m.Parse("not-a-jwt"); err == nil {
+		t.Fatal("expected error for invalid token")
+	}
 }
 
 func TestExpiredToken(t *testing.T) {
-	m := NewManager("test-secret", "openteam", -time.Minute, time.Hour)
-	tok, _, _ := m.Sign(1, "a", "user", "access")
+	m := NewManager("test-secret", "openteam", -time.Hour, -time.Hour)
+	tok, _, err := m.Sign(1, "bob", "user", "access")
+	if err != nil {
+		t.Fatalf("Sign: %v", err)
+	}
 	if _, err := m.Parse(tok); err == nil {
-		t.Fatal("expired token should fail")
-	}
-}
-
-func TestWrongSecret(t *testing.T) {
-	m1 := NewManager("secret-a", "openteam", time.Hour, time.Hour)
-	m2 := NewManager("secret-b", "openteam", time.Hour, time.Hour)
-	tok, _, _ := m1.Sign(1, "a", "user", "access")
-	if _, err := m2.Parse(tok); err == nil {
-		t.Fatal("token signed with different secret should fail")
+		t.Fatal("expected error for expired token")
 	}
 }