fix: isort import排序

- 集成测试从Validate拆出为独立Integration Tests job，PR页面可见独立状态
- runner标签从ubuntu-22.04改为host（适配当前runner配置）
- 清理废workflow: tests.yml / test-ssh-secret.yml / auto-merge.yml
- Verify步骤python命令改为python3

.gitea/workflows/debug-cmd-agent.yml

@@ -1,44 +0,0 @@
-name: Debug CMD Agent
-
-on:
-  push:
-    branches:
-      - 'debug/cmd-agent'
-
-jobs:
-  debug:
-    name: Debug CMD Agent
-    runs-on: host
-    timeout-minutes: 5
-    steps:
-      - name: Diagnose
-        shell: bash
-        run: |
-          set +e
-          echo "=== 1. CMD Agent config ==="
-          cat /opt/xiaoxia-cmd-agent/config.json 2>/dev/null || cat /opt/xiaoxia-cmd-agent/config.yaml 2>/dev/null || echo "no config found"
-          ls -la /opt/xiaoxia-cmd-agent/ 2>/dev/null
-
-          echo ""
-          echo "=== 2. CMD Agent process ==="
-          ps aux | grep cmd-agent | grep -v grep
-
-          echo ""
-          echo "=== 3. Local curl test (127.0.0.1:18888) ==="
-          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
-            -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7" \
-            -H "Content-Type: application/json" \
-            -d '{"command":"hostname"}' 2>&1 || echo "FAILED"
-
-          echo ""
-          echo "=== 4. Nginx config for cmd-agent ==="
-          grep -r "cmd-agent" /etc/nginx/sites-enabled/ 2>/dev/null || \
-          grep -r "cmd-agent" /etc/nginx/conf.d/ 2>/dev/null || \
-          echo "no nginx cmd-agent config found"
-
-          echo ""
-          echo "=== 5. Nginx access log (last 5 lines) ==="
-          tail -5 /var/log/nginx/access.log 2>/dev/null | grep cmd || echo "no log"
-
-          echo ""
-          echo "=== DONE ==="

.gitea/workflows/fix-cmd-agent-auth.yml

@@ -1,46 +0,0 @@
-name: Fix CMD Agent Auth
-
-on:
-  push:
-    branches:
-      - 'debug/cmd-agent'
-
-jobs:
-  fix:
-    runs-on: host
-    steps:
-      - name: 验证不带Bearer
-        run: |
-          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
-      - name: 验证带Bearer（应该失败）
-        run: |
-          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
-      - name: 读取当前server.py的check_auth
-        run: |
-          grep -A 5 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
-      - name: 修复check_auth函数
-        run: |
-          cp /opt/xiaoxia-cmd-agent/server.py /opt/xiaoxia-cmd-agent/server.py.bak
-          sed -i '/def check_auth/,/return True/{
-            /def check_auth/a\        t = self.headers.get("Authorization", "")
-            /if t != AUTH_TOKEN/i\        if t.startswith("Bearer "):\n            t = t[7:]
-          }' /opt/xiaoxia-cmd-agent/server.py
-          echo "Done via sed"
-      - name: 验证修复后的check_auth
-        run: |
-          grep -A 8 "def check_auth" /opt/xiaoxia-cmd-agent/server.py
-      - name: 重启服务
-        run: |
-          systemctl restart xiaoxia-cmd-agent
-      - name: 等待服务启动
-        run: |
-          sleep 3
-      - name: 修复后验证-不带Bearer
-        run: |
-          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: xsa-f2778a6953d59948cd1e5be4d99f60f7"
-      - name: 修复后验证-带Bearer
-        run: |
-          curl -s -w "\nHTTP_CODE:%{http_code}" http://127.0.0.1:18888/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"
-      - name: 公网路径验证
-        run: |
-          curl -sk -w "\nHTTP_CODE:%{http_code}" https://127.0.0.1/cmd-agent/status -H "Authorization: Bearer xsa-f2778a6953d59948cd1e5be4d99f60f7"

.gitea/workflows/read-auth.yml

@@ -1,38 +0,0 @@
-name: Read Auth Logic
-
-on:
-  push:
-    branches:
-      - 'debug/cmd-agent'
-
-jobs:
-  read:
-    name: Read check_auth logic
-    runs-on: host
-    timeout-minutes: 3
-    steps:
-      - name: Read
-        shell: bash
-        run: |
-          echo "=== Full server.py (lines 1-50) ==="
-          sed -n '1,50p' /opt/xiaoxia-cmd-agent/server.py
-          echo ""
-          echo "=== Lines 120-160 (startup logic) ==="
-          sed -n '120,160p' /opt/xiaoxia-cmd-agent/server.py
-          echo ""
-          echo "=== Test with X-Token header ==="
-          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
-            -H "X-Token: $(cat /etc/xiaoxia-cmd-agent.token)" \
-            -H "Content-Type: application/json" \
-            -d '{"command":"hostname"}'
-          echo ""
-          echo "=== Test with token in query string ==="
-          curl -s -X POST "http://127.0.0.1:18888/cmd-agent/exec?token=$(cat /etc/xiaoxia-cmd-agent.token)" \
-            -H "Content-Type: application/json" \
-            -d '{"command":"hostname"}'
-          echo ""
-          echo "=== Check if path is /exec not /cmd-agent/exec ==="
-          curl -s -X POST http://127.0.0.1:18888/exec \
-            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
-            -H "Content-Type: application/json" \
-            -d '{"command":"hostname"}'

.gitea/workflows/read-cmd-agent.yml

@@ -1,27 +0,0 @@
-name: Read CMD Agent Source
-
-on:
-  push:
-    branches:
-      - 'debug/cmd-agent'
-
-jobs:
-  read:
-    name: Read CMD Agent server.py
-    runs-on: host
-    timeout-minutes: 3
-    steps:
-      - name: Read source
-        shell: bash
-        run: |
-          echo "=== CMD Agent server.py (first 80 lines) ==="
-          head -80 /opt/xiaoxia-cmd-agent/server.py
-          echo ""
-          echo "=== Token-related lines ==="
-          grep -n -i "token\|auth\|secret\|key" /opt/xiaoxia-cmd-agent/server.py
-          echo ""
-          echo "=== Systemd service config ==="
-          cat /etc/systemd/system/xiaoxia-cmd-agent.service 2>/dev/null || echo "no systemd service"
-          echo ""
-          echo "=== Environment variables from process ==="
-          cat /proc/1034/environ 2>/dev/null | tr '\0' '\n' | grep -i "token\|auth\|secret\|key" || echo "no env vars found"

.gitea/workflows/read-token.yml

@@ -1,30 +0,0 @@
-name: Read CMD Agent Token
-
-on:
-  push:
-    branches:
-      - 'debug/cmd-agent'
-
-jobs:
-  read:
-    name: Read Real Token
-    runs-on: host
-    timeout-minutes: 3
-    steps:
-      - name: Read
-        shell: bash
-        run: |
-          echo "=== Real CMD Agent Token ==="
-          cat /etc/xiaoxia-cmd-agent.token
-          echo ""
-          echo "=== Test with real token ==="
-          curl -s -X POST http://127.0.0.1:18888/cmd-agent/exec \
-            -H "Authorization: Bearer $(cat /etc/xiaoxia-cmd-agent.token)" \
-            -H "Content-Type: application/json" \
-            -d '{"command":"hostname && whoami"}'
-          echo ""
-          echo "=== Nginx config for cmd-agent (full) ==="
-          sed -n '/cmd-agent/,/}/p' /etc/nginx/sites-enabled/00-xiaoxia-saas | head -20
-          echo ""
-          echo "=== All listening ports ==="
-          ss -tlnp | head -20