fix: 修复 44 个代码审查问题 (CRITICAL/HIGH/MEDIUM/LOW)

Batch 1 — CRITICAL (1):
- 提取 is_safe_path() 到 src/core/security.py 公共模块
- CLI 和 ingest_obsidian.py 统一添加路径遍历防护

Batch 2 — HIGH (13) + 架构重构:
- CLI 复用 deps.py AppState, 消除 30 行重复代码
- AppState/get_state 添加线程安全锁
- serve 命令传递 --config 到 uvicorn (H1)
- OpenAIEmbedder 懒创建+复用 HTTP 客户端 (H2)
- DashscopeEmbedder import 移到模块顶部 (H3)
- 路径检查改用 os.path.commonpath (H4)
- embedder.embed() 返回值长度检查 (H5)
- 健康检查不泄露内部错误详情 (H7)
- /api/v1/collections 添加 API Key 认证 (H8)
- API Key 使用 hmac.compare_digest 恒定时间比较 (H9)
- 添加 CORS 中间件 (H10)
- ServerConfig 支持 SSL 配置 (H11)
- HF_ENDPOINT 修改添加详细注释 (H12)

Batch 3 — MEDIUM (20) + Splitter Protocol:
- 定义 Splitter(Protocol) 接口, DocumentIngestor 接受可选 splitter
- DashScope 响应添加结构验证 (M2)
- ingest_obsidian.py 支持 CLI 参数和 OBSIDIAN_DIRS 环境变量 (M6)
- scripts/serve.py 添加废弃警告 (M7)
- content 限制 500KB, collection 正则限制字符集 (M12-M14)
- 默认监听地址 127.0.0.1 (M16)
- 添加安全响应头中间件 (M17)
- verify_api_key 认证失败记录日志 (M19)

Batch 4 — LOW (10):
- CLI emoji 清理为纯文本标记 (L5)
- logging.basicConfig 移到 FastAPI lifespan (L1)
- VectorDB 添加 write_guard() 上下文管理器 (L3)
- IngestRequest file_path/content 互斥校验 (L10)
- ingest_obsidian.py 注释修正 (L6)

测试: 46 → 70 (+24)
- tests/test_security.py: 11 个路径安全测试
- tests/test_deps.py: 11 个依赖注入测试

Co-Authored-By: Claude <noreply@anthropic.com>

src/server/deps.py

@@ -1,5 +1,6 @@
 """FastAPI 依赖注入 — 集中管理应用状态, 替代模块级全局变量."""
 import os
+import threading
 import logging
 
 from src.core.config import load_config
@@ -31,31 +32,37 @@ class AppState:
         # 按 collection 懒加载 searcher / ingestor
         self._searchers: dict[str, Searcher] = {}
         self._ingestors: dict[str, DocumentIngestor] = {}
+        self._cache_lock = threading.Lock()
 
     def get_searcher(self, collection: str | None = None) -> Searcher:
         name = collection or self.default_collection
-        if name not in self._searchers:
-            self._searchers[name] = Searcher(self.db, self.embedder, name)
-        return self._searchers[name]
+        with self._cache_lock:
+            if name not in self._searchers:
+                self._searchers[name] = Searcher(self.db, self.embedder, name)
+            return self._searchers[name]
 
     def get_ingestor(self, collection: str | None = None) -> DocumentIngestor:
         name = collection or self.default_collection
-        if name not in self._ingestors:
-            self._ingestors[name] = DocumentIngestor(self.db, self.embedder, name)
-        return self._ingestors[name]
+        with self._cache_lock:
+            if name not in self._ingestors:
+                self._ingestors[name] = DocumentIngestor(self.db, self.embedder, name)
+            return self._ingestors[name]
 
     def list_collections_with_stats(self) -> list[dict]:
         """列出所有 collection 及其统计（直接从 ChromaDB 查询）."""
         result = []
         try:
-            for coll in self.db.client.list_collections():
+            for coll in self.db.list_collections():
                 result.append({"name": coll.name, "count": coll.count()})
         except Exception:
             logger.exception("列出集合失败")
         return result
 
     def is_healthy(self) -> dict:
-        """真实健康检查: 验证 ChromaDB 和 Embedder 是否可用."""
+        """真实健康检查: 验证 ChromaDB 和 Embedder 是否可用.
+
+        对外仅返回 ok/degraded 状态，详细信息记入日志，不泄露内部路径.
+        """
         status = {"status": "ok", "checks": {}}
         try:
             count = self.db.get_or_create_collection(
@@ -63,26 +70,31 @@ class AppState:
             ).count()
             status["checks"]["chromadb"] = {"status": "ok", "count": count}
         except Exception as e:
-            status["checks"]["chromadb"] = {"status": "error", "detail": str(e)}
+            logger.error("ChromaDB 健康检查失败: %s", e)
+            status["checks"]["chromadb"] = {"status": "error", "detail": "unavailable"}
             status["status"] = "degraded"
         try:
             dim = self.embedder.dimension
             status["checks"]["embedder"] = {"status": "ok", "dimension": dim}
         except Exception as e:
-            status["checks"]["embedder"] = {"status": "error", "detail": str(e)}
+            logger.error("Embedder 健康检查失败: %s", e)
+            status["checks"]["embedder"] = {"status": "error", "detail": "unavailable"}
             status["status"] = "degraded"
         return status
 
 
 _state: AppState | None = None
+_state_lock = threading.Lock()
 
 
 def get_state() -> AppState:
-    """获取应用状态单例 (懒初始化)."""
+    """获取应用状态单例 (懒初始化, 线程安全)."""
     global _state
     if _state is None:
-        logger.info("初始化应用状态...")
-        _state = AppState()
+        with _state_lock:
+            if _state is None:
+                logger.info("初始化应用状态...")
+                _state = AppState()
     return _state