chore: 全面代码审查修复 + 开源标配完善

## 审查修复 (18 项)
- TitleBar 版本号改为动态 import package.json
- CLI profile_apply 加 verify_and_save 原子性保护
- CLI 新增 profile rename 子命令
- cmd_clean 默认清理 system+user 两个 hive
- Rust import_csv 加 BOM/header 处理
- exportToJson/exportToCsv 保留 enabled 状态
- CLI version 使用 env!("CARGO_PKG_VERSION")
- export_paths 返回 Result, 未知格式报错
- importFromContent 未知扩展名 throw Error
- profile 文件名加路径遍历/Win保留字校验
- 数据路径统一到 ~/.patheditor/

## clippy (18 处修复)
- backup/scanner/system/profiles: empty_line_after_doc_comments
- profiles: needless_borrow ×5, unnecessary_map_or
- scanner: collapsible_if
- cli: nonminimal_bool ×6, implicit_saturating_sub, to_string_in_format_args
- 零警告通过

## 测试 (33 条新增)
- Rust: backup(3) + disabled(1) + fs(13) + scanner(4) + profiles(1) = 25 条
- 前端: merge-preview(2) + analyze-dialog(1) + import-parity(5) = 8 条
- Rust 10→35, 前端 72→80

## Scanner 并行化
- std::thread::scope 多线程并行扫描目录，N 倍性能提升

## expand_env_vars UTF-16 修复
- 非法码点编码为 \u{XXXX} 而非静默丢弃

## 开源标配
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- SECURITY.md (漏洞报告流程)
- .github/PULL_REQUEST_TEMPLATE.md
- CONTRIBUTING.md (贡献指南)
- CHANGELOG.md (v4.0~v5.0)

## E2E 测试 (4 条新增)
- keyboard / analyze / profiles / import-export
- IPC mock 扩展 scan/profiles 命令

## CI
- Rust job 目录调整为 workspace 根

## 其他
- rustdoc: 8 个 pub fn 补文档注释
- 帮助文本 v4.0→v5.0
- 前后端导入逻辑加交叉引用注释
- .gitignore 添加 target/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/analyze-dialog.test.tsx

@@ -0,0 +1,37 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@testing-library/react';
+import { AnalyzeDialog } from '../../src/components/dialogs/AnalyzeDialog';
+
+vi.mock('@tauri-apps/api/core', () => ({
+  invoke: vi.fn((cmd: string) => {
+    if (cmd === 'scan_conflicts') return Promise.resolve([]);
+    if (cmd === 'scan_tools') return Promise.resolve([]);
+    return Promise.resolve(undefined);
+  }),
+}));
+
+vi.mock('@/store/app-store', () => ({
+  useAppStore: Object.assign(
+    vi.fn((selector) => {
+      const state = { sysPaths: [], userPaths: [] };
+      return selector(state);
+    }),
+    { getState: () => ({ sysPaths: [], userPaths: [] }) },
+  ),
+}));
+
+vi.mock('@/i18n', () => ({
+  default: { t: vi.fn((key: string) => key) },
+}));
+
+describe('AnalyzeDialog', () => {
+  it('渲染冲突检测和工具清单标签页，不崩溃', () => {
+    const { container } = render(
+      <AnalyzeDialog open={true} onClose={() => {}} />,
+    );
+    const text = container.textContent || '';
+    expect(text).toContain('analyze.conflicts');
+    expect(text).toContain('analyze.tools');
+  });
+});

tests/unit/import-export.test.ts

@@ -24,11 +24,12 @@ describe('exportToJson', () => {
   it('导出结构化 JSON', () => {
     const json = exportToJson(sampleData);
     const parsed = JSON.parse(json);
-    expect(parsed.version).toBe('1.0');
-    expect(parsed.type).toBe('PathEditor');
-    expect(parsed.system).toEqual(sampleData.system.map(e => e.path));
-    expect(parsed.user).toEqual(sampleData.user.map(e => e.path));
-    expect(parsed.exported).toBeDefined();
+    expect(parsed.version).toBe('5.0.0');
+    expect(parsed.timestamp).toBeDefined();
+    expect(parsed.system.map((e: { path: string }) => e.path)).toEqual(sampleData.system.map(e => e.path));
+    expect(parsed.user.map((e: { path: string }) => e.path)).toEqual(sampleData.user.map(e => e.path));
+    expect(parsed.system[0].enabled).toBe(true);
+    expect(parsed.user[0].enabled).toBe(true);
   });
 });
 
@@ -54,21 +55,21 @@ describe('exportToCsv', () => {
   it('导出 CSV 含 BOM', () => {
     const csv = exportToCsv(sampleData);
     expect(csv.startsWith('')).toBe(true);
-    expect(csv).toContain('type,path');
-    expect(csv).toContain('system,C:\\Windows');
-    expect(csv).toContain('user,C:\\Users\\me\\AppData');
+    expect(csv).toContain('type,path,enabled');
+    expect(csv).toContain('system,C:\\Windows,true');
+    expect(csv).toContain('user,C:\\Users\\me\\AppData,true');
   });
 
   it('CSV 字段转义', () => {
     const data = { system: [pe('C:\\Path,with,commas')], user: [] };
     const csv = exportToCsv(data);
-    expect(csv).toContain('"C:\\Path,with,commas"');
+    expect(csv).toContain('"C:\\Path,with,commas",true');
   });
 
   it('CSV 双引号转义', () => {
     const data = { system: [pe('Path with "quotes"')], user: [] };
     const csv = exportToCsv(data);
-    expect(csv).toContain('"Path with ""quotes"""');
+    expect(csv).toContain('"Path with ""quotes""",true');
   });
 });
 

tests/unit/import-parity.test.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect } from 'vitest';
+import { importFromCsv, importFromJson, importFromTxt } from '../../src/core/import-export';
+
+describe('导入一致性（TS 端）', () => {
+  it('JSON 含 system + user', () => {
+    const json = JSON.stringify({ system: ['C:\\a', 'C:\\b'], user: ['D:\\c'] });
+    const r = importFromJson(json);
+    expect(r.system.map(e => e.path)).toEqual(['C:\\a', 'C:\\b']);
+    expect(r.user.map(e => e.path)).toEqual(['D:\\c']);
+  });
+
+  it('CSV system/user 分类', () => {
+    const csv = 'type,path\nsystem,C:\\sys\nuser,D:\\usr\n';
+    const r = importFromCsv(csv);
+    expect(r.system.map(e => e.path)).toEqual(['C:\\sys']);
+    expect(r.user.map(e => e.path)).toEqual(['D:\\usr']);
+  });
+
+  it('CSV 含 BOM + header', () => {
+    const csv = 'type,path\nsystem,C:\\x\n';
+    const r = importFromCsv(csv);
+    expect(r.system.map(e => e.path)).toEqual(['C:\\x']);
+  });
+
+  it('TXT 逐行读取，跳过注释', () => {
+    const txt = '# comment\nC:\\a\n\nD:\\b\n';
+    const r = importFromTxt(txt);
+    expect(r.map(e => e.path)).toEqual(['C:\\a', 'D:\\b']);
+  });
+
+  it('JSON 空数据不崩溃', () => {
+    const r = importFromJson('{}');
+    expect(r.system).toEqual([]);
+    expect(r.user).toEqual([]);
+  });
+});

tests/unit/merge-preview.test.tsx

@@ -0,0 +1,39 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi } from 'vitest';
+import { render } from '@testing-library/react';
+import { MergePreview } from '../../src/components/path-list/MergePreview';
+
+vi.mock('@/store/app-store', () => ({
+  useAppStore: vi.fn((selector) => {
+    const state = {
+      sysPaths: [
+        { path: 'C:\\Windows', enabled: true },
+        { path: 'C:\\Disabled', enabled: false },
+      ],
+      userPaths: [
+        { path: 'D:\\UserApp', enabled: true },
+      ],
+      searchQuery: '',
+    };
+    return selector(state);
+  }),
+}));
+
+vi.mock('@/i18n', () => ({
+  default: { t: vi.fn((key: string) => key) },
+}));
+
+describe('MergePreview', () => {
+  it('合并显示系统+用户路径', () => {
+    const { container } = render(<MergePreview />);
+    const text = container.textContent || '';
+    expect(text).toContain('C:\\Windows');
+    expect(text).toContain('D:\\UserApp');
+  });
+
+  it('disabled 路径在表格中存在', () => {
+    const { container } = render(<MergePreview />);
+    const text = container.textContent || '';
+    expect(text).toContain('C:\\Disabled');
+  });
+});