chore: 全面代码审查修复 + 开源标配完善

## 审查修复 (18 项)
- TitleBar 版本号改为动态 import package.json
- CLI profile_apply 加 verify_and_save 原子性保护
- CLI 新增 profile rename 子命令
- cmd_clean 默认清理 system+user 两个 hive
- Rust import_csv 加 BOM/header 处理
- exportToJson/exportToCsv 保留 enabled 状态
- CLI version 使用 env!("CARGO_PKG_VERSION")
- export_paths 返回 Result, 未知格式报错
- importFromContent 未知扩展名 throw Error
- profile 文件名加路径遍历/Win保留字校验
- 数据路径统一到 ~/.patheditor/

## clippy (18 处修复)
- backup/scanner/system/profiles: empty_line_after_doc_comments
- profiles: needless_borrow ×5, unnecessary_map_or
- scanner: collapsible_if
- cli: nonminimal_bool ×6, implicit_saturating_sub, to_string_in_format_args
- 零警告通过

## 测试 (33 条新增)
- Rust: backup(3) + disabled(1) + fs(13) + scanner(4) + profiles(1) = 25 条
- 前端: merge-preview(2) + analyze-dialog(1) + import-parity(5) = 8 条
- Rust 10→35, 前端 72→80

## Scanner 并行化
- std::thread::scope 多线程并行扫描目录，N 倍性能提升

## expand_env_vars UTF-16 修复
- 非法码点编码为 \u{XXXX} 而非静默丢弃

## 开源标配
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- SECURITY.md (漏洞报告流程)
- .github/PULL_REQUEST_TEMPLATE.md
- CONTRIBUTING.md (贡献指南)
- CHANGELOG.md (v4.0~v5.0)

## E2E 测试 (4 条新增)
- keyboard / analyze / profiles / import-export
- IPC mock 扩展 scan/profiles 命令

## CI
- Rust job 目录调整为 workspace 根

## 其他
- rustdoc: 8 个 pub fn 补文档注释
- 帮助文本 v4.0→v5.0
- 前后端导入逻辑加交叉引用注释
- .gitignore 添加 target/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

core/src/scanner.rs

@@ -23,33 +23,50 @@ pub struct ToolGroup {
     pub exes: Vec<String>,
 }
 
-/// 扫描 PATH 中的可执行文件冲突
-///
-/// 遍历每个 PATH 目录，查找 .exe/.bat/.cmd/.com/.ps1 文件，
-/// 标记出现在多个目录中的同名文件（后面的目录会被前面的「遮蔽」）
-
-pub fn scan_conflicts(paths: Vec<String>) -> Result<Vec<ConflictEntry>, String> {
-    // exe_name (小写) → [(priority, dir)]
-    let mut map: HashMap<String, Vec<(usize, String)>> = HashMap::new();
-
-    for (priority, dir) in paths.iter().enumerate() {
-        let p = Path::new(dir);
-        if !p.is_dir() {
-            continue;
-        }
-        let entries = fs::read_dir(p).map_err(|e| format!("无法读取目录 {}: {}", dir, e))?;
+/// 扫描单个目录中的可执行文件名
+fn list_exes(dir: &str) -> Vec<String> {
+    let p = Path::new(dir);
+    if !p.is_dir() {
+        return vec![];
+    }
+    let mut exes: Vec<String> = Vec::new();
+    if let Ok(entries) = fs::read_dir(p) {
         for entry in entries.flatten() {
             let fname = entry.file_name();
             let name = fname.to_string_lossy();
             if let Some(ext) = Path::new(name.as_ref()).extension() {
                 let ext_lower = ext.to_ascii_lowercase();
                 if EXECUTABLE_EXTENSIONS.contains(&ext_lower.to_str().unwrap_or("")) {
-                    let key = name.to_lowercase();
-                    map.entry(key).or_default().push((priority, dir.clone()));
+                    exes.push(name.to_string());
                 }
             }
         }
     }
+    exes
+}
+
+/// 扫描 PATH 中的可执行文件冲突
+///
+/// 并行遍历每个 PATH 目录，查找 .exe/.bat/.cmd/.com/.ps1 文件，
+/// 标记出现在多个目录中的同名文件（后面的目录会被前面的「遮蔽」）
+pub fn scan_conflicts(paths: Vec<String>) -> Result<Vec<ConflictEntry>, String> {
+    // 并行扫描各目录
+    let results: Vec<(usize, String, Vec<String>)> = std::thread::scope(|s| {
+        let handles: Vec<_> = paths.iter().enumerate().map(|(priority, dir)| {
+            s.spawn(move || (priority, dir.clone(), list_exes(dir)))
+        }).collect();
+        handles.into_iter().map(|h| h.join().unwrap()).collect()
+    });
+
+    // 合并: exe_name (小写) → [(priority, dir)]
+    let mut map: HashMap<String, Vec<(usize, String)>> = HashMap::new();
+    for (priority, dir, exes) in results {
+        for name in exes {
+            map.entry(name.to_lowercase())
+                .or_default()
+                .push((priority, dir.clone()));
+        }
+    }
 
     let mut results: Vec<ConflictEntry> = map
         .into_iter()
@@ -69,45 +86,96 @@ pub fn scan_conflicts(paths: Vec<String>) -> Result<Vec<ConflictEntry>, String>
 
 /// 扫描 PATH 中各目录提供的可执行文件
 ///
-/// query 非空时只返回文件名包含关键词的结果
+/// query 非空时只返回文件名包含关键词的结果。各目录并行扫描。
 pub fn scan_tools(paths: Vec<String>, query: String) -> Result<Vec<ToolGroup>, String> {
     let query_lower = query.to_lowercase();
-    let mut groups: Vec<ToolGroup> = Vec::new();
 
-    for dir in &paths {
-        let p = Path::new(dir);
-        if !p.is_dir() {
-            groups.push(ToolGroup {
-                dir: dir.clone(),
-                exists: false,
-                exes: vec![],
-            });
-            continue;
-        }
-
-        let entries = fs::read_dir(p).map_err(|e| format!("无法读取目录 {}: {}", dir, e))?;
-        let mut exes: Vec<String> = Vec::new();
-
-        for entry in entries.flatten() {
-            let fname = entry.file_name();
-            let name = fname.to_string_lossy();
-            if let Some(ext) = Path::new(name.as_ref()).extension() {
-                let ext_lower = ext.to_ascii_lowercase();
-                if EXECUTABLE_EXTENSIONS.contains(&ext_lower.to_str().unwrap_or("")) {
-                    if query_lower.is_empty() || name.to_lowercase().contains(&query_lower) {
-                        exes.push(name.to_string());
-                    }
+    // 并行扫描各目录
+    let dir_results: Vec<(String, Option<Vec<String>>)> = std::thread::scope(|s| {
+        let handles: Vec<_> = paths.iter().map(|dir| {
+            s.spawn(move || {
+                let p = Path::new(dir);
+                if !p.is_dir() {
+                    return (dir.clone(), None);
                 }
+                let exes = list_exes(dir);
+                (dir.clone(), Some(exes))
+            })
+        }).collect();
+        handles.into_iter().map(|h| h.join().unwrap()).collect()
+    });
+
+    let mut groups: Vec<ToolGroup> = Vec::new();
+    for (dir, opt_exes) in dir_results {
+        match opt_exes {
+            None => {
+                groups.push(ToolGroup { dir, exists: false, exes: vec![] });
+            }
+            Some(mut exes) => {
+                if !query_lower.is_empty() {
+                    exes.retain(|name| name.to_lowercase().contains(&query_lower));
+                }
+                exes.sort();
+                groups.push(ToolGroup { dir, exists: true, exes });
             }
         }
-
-        exes.sort();
-        groups.push(ToolGroup {
-            dir: dir.clone(),
-            exists: true,
-            exes,
-        });
     }
 
     Ok(groups)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+
+    fn make_temp_dir_with_exes(prefix: &str, exe_names: &[&str]) -> std::path::PathBuf {
+        let dir = std::env::temp_dir().join(format!("patheditor_test_{}", prefix));
+        fs::create_dir_all(&dir).unwrap();
+        for name in exe_names {
+            fs::write(dir.join(name), b"fake").unwrap();
+        }
+        dir
+    }
+
+    #[test]
+    fn scan_conflicts_no_duplicates() {
+        let d1 = make_temp_dir_with_exes("c_a", &["a.exe"]);
+        let d2 = make_temp_dir_with_exes("c_b", &["b.exe"]);
+        let paths = vec![d1.to_string_lossy().to_string(), d2.to_string_lossy().to_string()];
+        let conflicts = scan_conflicts(paths).unwrap();
+        assert!(conflicts.is_empty());
+    }
+
+    #[test]
+    fn scan_conflicts_detects_duplicate() {
+        let d1 = make_temp_dir_with_exes("c_dup1", &["shared.exe"]);
+        let d2 = make_temp_dir_with_exes("c_dup2", &["shared.exe"]);
+        let paths = vec![d1.to_string_lossy().to_string(), d2.to_string_lossy().to_string()];
+        let conflicts = scan_conflicts(paths).unwrap();
+        assert_eq!(conflicts.len(), 1);
+        assert_eq!(conflicts[0].locations.len(), 2);
+        assert_eq!(conflicts[0].locations[0].priority, 0);
+        assert_eq!(conflicts[0].locations[1].priority, 1);
+    }
+
+    #[test]
+    fn scan_tools_returns_groups() {
+        let d1 = make_temp_dir_with_exes("t_a", &["tool.exe", "helper.bat"]);
+        let paths = vec![d1.to_string_lossy().to_string()];
+        let groups = scan_tools(paths, String::new()).unwrap();
+        assert_eq!(groups.len(), 1);
+        assert!(groups[0].exists);
+        assert!(groups[0].exes.contains(&"helper.bat".to_string()));
+        assert!(groups[0].exes.contains(&"tool.exe".to_string()));
+    }
+
+    #[test]
+    fn scan_tools_with_query_filters() {
+        let d1 = make_temp_dir_with_exes("t_q", &["apple.exe", "banana.exe"]);
+        let paths = vec![d1.to_string_lossy().to_string()];
+        let groups = scan_tools(paths, "apple".into()).unwrap();
+        assert_eq!(groups[0].exes.len(), 1);
+        assert_eq!(groups[0].exes[0], "apple.exe");
+    }
+}