refactor(api): quarantine legacy container routes

apps/api/app/api/routes/__init__.py

@@ -1,5 +1,17 @@
-"""Compatibility exports for the canonical API router module."""
+"""API route package.
+
+The canonical aggregated router lives in `app.api.router`. This package must not
+import route modules at package-import time, otherwise importing any sub-route can
+trigger circular imports and optional infrastructure dependencies.
+"""
+
+
+def __getattr__(name: str):
+    if name in {"api_router", "health_router"}:
+        from app.api.router import api_router, health_router
+
+        return {"api_router": api_router, "health_router": health_router}[name]
+    raise AttributeError(name)
 
-from app.api.router import api_router, health_router
 
 __all__ = ["api_router", "health_router"]

apps/api/app/api/routes/auth.py

@@ -1,6 +1,14 @@
 """
-认证 API 路由
+Legacy full-auth API route skeleton.
+
+This module is intentionally disabled until the DI container/auth ports are rebuilt.
+Do not mount it directly; use `auth_simple.py` only as the current compatibility route.
 """
+
+raise RuntimeError(
+    "apps.api.app.api.routes.auth is disabled: rebuild DI container before mounting full auth routes"
+)
+
 from fastapi import APIRouter, HTTPException, status, Depends, Request
 from pydantic import BaseModel, EmailStr
 

apps/api/app/api/routes/workspaces.py

@@ -1,6 +1,14 @@
 """
-Workspace API 路由（完整实现）
+Legacy workspace API route skeleton.
+
+This module depends on the removed DI container and is intentionally disabled until
+workspace use cases are wired through the canonical API composition root.
 """
+
+raise RuntimeError(
+    "apps.api.app.api.routes.workspaces is disabled: rebuild DI container before mounting workspace routes"
+)
+
 from fastapi import APIRouter, HTTPException, status, Depends
 from pydantic import BaseModel, EmailStr
 from typing import List

apps/api/app/middleware/auth.py

@@ -1,6 +1,14 @@
 """
-认证中间件和依赖
+Legacy auth middleware.
+
+Disabled because it depends on the removed DI container. Rebuild it around the
+canonical JWT settings and SQLAlchemy-backed user repository before reuse.
 """
+
+raise RuntimeError(
+    "apps.api.app.middleware.auth is disabled: rebuild auth dependency wiring before importing it"
+)
+
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 

docs/全面代码审计报告-2026-06-21.md

@@ -101,6 +101,24 @@
 - `app/core/config.py` 改为兼容转发层，只 re-export canonical Settings/get_settings/settings。
 - 避免未来继续在旧文件增加新字段导致漂移。
 
+### 6. P1：旧认证/工作空间路由引用已移除的 DI Container
+
+**涉及文件**：`apps/api/app/api/routes/auth.py`、`apps/api/app/api/routes/workspaces.py`、`apps/api/app/middleware/auth.py`
+
+**问题**：
+- 旧完整认证和 workspace 路由引用 `get_container()`。
+- `apps/api/app/dependencies.py` 已无 `get_container()`。
+- 当前 canonical router 未挂载它们，但任何误导入都会成为运行时炸弹。
+
+**根因**：
+- DI 重构后旧路由未删除也未迁移。
+- “完整实现”文件名误导后续开发者可能重新挂载坏代码。
+
+**修复**：
+- 旧模块顶部显式标记为 legacy disabled。
+- 误导入时立即抛出清晰错误，而不是深层 ImportError。
+- 后续只能在重建 DI composition root 后重新启用。
+
 ## 三、已补充测试
 
 ### 新增