feat: MeshSafe 文件摆渡安全卫士 v1.0 初始提交

核心功能:
- 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制
- FastAPI + PostgreSQL + Redis + Docker Compose 架构
- 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性
- 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页)
- 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min)

并发与稳定性修复:
- 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行)
- JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写
- 移除 SQLite fallback, 统一 PostgreSQL
- API_CLIENTS 脱敏为环境变量, .env 已 .gitignore

tests/_yara_check.py

@@ -0,0 +1,42 @@
+import yara, os
+os.chdir(r'd:\project\MeshSafe')
+rules = yara.compile(filepaths={f: os.path.join('rules', f) for f in os.listdir('rules') if f.endswith('.yar')})
+
+# 测 PHP eval
+import tempfile
+tmp = tempfile.NamedTemporaryFile(delete=False, suffix='.php', mode='wb')
+tmp.write(b'<?php eval($_POST["cmd"]); echo "ok"; ?>')
+tmp.close()
+matches = rules.match(tmp.name)
+print(f'PHP eval: {[m.rule for m in matches]}')
+os.unlink(tmp.name)
+
+# 测 PE
+pe_path = 'tests/samples/pe_injection.exe'
+if os.path.exists(pe_path):
+    matches = rules.match(pe_path)
+    print(f'PE injection: {[m.rule for m in matches]}')
+
+# 测 PHP 文件（用真实样本）
+php_path = 'tests/samples/shell_php_eval.php'
+if os.path.exists(php_path):
+    matches = rules.match(php_path)
+    print(f'shell_php_eval.php: {[m.rule for m in matches]}')
+
+# 测 python reverse shell
+py_path = 'tests/samples/shell_python.py'
+if os.path.exists(py_path):
+    matches = rules.match(py_path)
+    print(f'shell_python.py: {[m.rule for m in matches]}')
+
+# 测 certutil lolbin
+lol_path = 'tests/samples/lolbin.cmd'
+if os.path.exists(lol_path):
+    matches = rules.match(lol_path)
+    print(f'lolbin.cmd: {[m.rule for m in matches]}')
+
+# 测 normal_deploy.sh
+sh_path = 'tests/samples/normal_deploy.sh'
+if os.path.exists(sh_path):
+    matches = rules.match(sh_path)
+    print(f'normal_deploy.sh: {[m.rule for m in matches]}')