feat: MeshSafe 文件摆渡安全卫士 v1.0 初始提交

核心功能:
- 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制
- FastAPI + PostgreSQL + Redis + Docker Compose 架构
- 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性
- 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页)
- 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min)

并发与稳定性修复:
- 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行)
- JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写
- 移除 SQLite fallback, 统一 PostgreSQL
- API_CLIENTS 脱敏为环境变量, .env 已 .gitignore

Dockerfile

@@ -0,0 +1,53 @@
+# ---- 构建阶段 ----
+FROM python:3.12-slim AS builder
+
+WORKDIR /app
+
+# 系统依赖：python-magic、ClamAV 客户端、编译工具
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libmagic1 libmagic-dev \
+    clamav clamav-daemon \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# ---- 运行阶段 ----
+FROM python:3.12-slim
+
+WORKDIR /app
+
+# 系统运行时依赖
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libmagic1 clamav clamav-daemon ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd -r meshsafe && useradd -r -g meshsafe -d /app meshsafe
+
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+# 应用代码
+COPY app/ ./app/
+COPY config/policy.yaml ./config/policy.yaml
+COPY config/diagnostics.yaml ./config/diagnostics.yaml
+COPY scripts/ ./scripts/
+COPY static/ ./static/
+COPY tests/ ./tests/
+
+# 日志目录、临时目录
+RUN mkdir -p /var/log/meshsafe /tmp/meshsafe /app/rules \
+    && chown -R meshsafe:meshsafe /app /var/log/meshsafe /tmp/meshsafe
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    MESHSAFE_LOG_DIR=/var/log/meshsafe \
+    MESHSAFE_TEMP_ROOT=/tmp/meshsafe
+
+USER meshsafe
+
+EXPOSE 8443
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()" || exit 1
+
+CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8443 --workers ${UVICORN_WORKERS:-1}"]