feat: 完成云同步、语音控制与多平台扩展基础架构搭建

本次提交完成了项目核心基础架构升级：
1. 新增动态API中间件与权限控制系统，支持匿名/鉴权接口分离
2. 搭建云同步服务体系，包含认证、任务同步、安全策略等核心模块
3. 实现语音控制全链路，从STT/意图解析到命令执行
4. 新增任务类型、附件实体与相关仓储接口
5. 重构前端配置与代理规则，统一后端端口为5057
6. 新增多平台测试项目与CI脚本优化
7. 完善项目文档与代码注释规范

移除了旧版迁移文件与冗余代理配置，调整项目结构适配跨平台部署需求。

test/Hua.Todo.Host.Tests/CloudSync/CloudSyncAuthSecurityPolicyTests.cs

@@ -0,0 +1,138 @@
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Hua.Todo.Application.Common;
+using Hua.Todo.Application.Repositories;
+using Hua.Todo.Application.Services.CloudSync.Models;
+using Hua.Todo.Core.Entities;
+using Hua.Todo.HttpApi.AspNetCore.CloudSync.Services;
+using Hua.Todo.HttpApi.AspNetCore.DynamicApi;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Xunit;
+
+namespace Hua.Todo.Host.Tests.CloudSync;
+
+/// <summary>
+/// CloudSync 登录后访问安全策略的端到端测试。
+/// 覆盖 DynamicApi 响应包装、SessionAuthenticationHandler 认证和 SecurityPolicyService 当前用户解析链路。
+/// </summary>
+public sealed class CloudSyncAuthSecurityPolicyTests : IDisposable
+{
+    private readonly SqliteConnection _connection;
+    private readonly WebApplication _app;
+    private readonly HttpClient _client;
+
+    /// <summary>
+    /// 创建使用 SQLite 内存库的最小 Host 管道。
+    /// </summary>
+    public CloudSyncAuthSecurityPolicyTests()
+    {
+        _connection = new SqliteConnection("Data Source=:memory:");
+        _connection.Open();
+
+        var builder = WebApplication.CreateBuilder();
+        builder.WebHost.UseUrls("http://127.0.0.1:0");
+        builder.Services.AddApplicationServices("Data Source=:memory:");
+        builder.Services.AddDbContext<TodoDbContext>(options => options.UseSqlite(_connection));
+        builder.Services.AddCloudSyncServer();
+
+        _app = builder.Build();
+        _app.UseAuthentication();
+        _app.UseAuthorization();
+        _app.UseDynamicApi();
+
+        using (var scope = _app.Services.CreateScope())
+        {
+            var db = scope.ServiceProvider.GetRequiredService<TodoDbContext>();
+            db.Database.EnsureCreated();
+            SeedAdmin(db, scope.ServiceProvider.GetRequiredService<IPasswordHasher<UserEntity>>());
+        }
+
+        _app.StartAsync().GetAwaiter().GetResult();
+        _client = new HttpClient { BaseAddress = new Uri(_app.Urls.First()) };
+    }
+
+    /// <summary>
+    /// 验证登录成功后，携带返回的 Bearer Token 能获取当前用户安全策略。
+    /// </summary>
+    [Fact]
+    public async Task GetSecurityPolicy_AfterLogin_ReturnsPolicy()
+    {
+        var loginResponse = await _client.PostAsJsonAsync("/api/auth/login", new LoginRequest
+        {
+            UserName = "admin",
+            Password = "123456"
+        });
+
+        Assert.Equal(HttpStatusCode.OK, loginResponse.StatusCode);
+        var loginPayload = await ReadDynamicApiResponseAsync<LoginResponse>(loginResponse);
+        Assert.True(loginPayload.Success);
+        Assert.False(string.IsNullOrWhiteSpace(loginPayload.Data?.AccessToken));
+
+        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", loginPayload.Data.AccessToken);
+        var policyResponse = await _client.GetAsync("/api/security/policy");
+
+        Assert.Equal(HttpStatusCode.OK, policyResponse.StatusCode);
+        var policyPayload = await ReadDynamicApiResponseAsync<SecurityPolicyDto>(policyResponse);
+        Assert.True(policyPayload.Success);
+        Assert.True(policyPayload.Data?.AllowPersist);
+        Assert.True(policyPayload.Data?.AllowSync);
+    }
+
+    /// <summary>
+    /// 释放测试 Host 与 SQLite 连接。
+    /// </summary>
+    public void Dispose()
+    {
+        _client.Dispose();
+        _app.StopAsync().GetAwaiter().GetResult();
+        _app.DisposeAsync().GetAwaiter().GetResult();
+        _connection.Dispose();
+    }
+
+    private static void SeedAdmin(TodoDbContext db, IPasswordHasher<UserEntity> hasher)
+    {
+        var user = new UserEntity
+        {
+            Id = Guid.NewGuid(),
+            UserName = "admin",
+            Role = "admin",
+            CreatedAtUtc = DateTime.UtcNow,
+            UpdatedAtUtc = DateTime.UtcNow
+        };
+        user.PasswordHash = hasher.HashPassword(user, "123456");
+
+        db.Users.Add(user);
+        db.SecurityPolicies.Add(new SecurityPolicyEntity
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            AllowPersist = true,
+            AllowSync = true,
+            IsTrustedDeviceOnly = false
+        });
+        db.SaveChanges();
+    }
+
+    private static async Task<DynamicApiPayload<T>> ReadDynamicApiResponseAsync<T>(HttpResponseMessage response)
+    {
+        var payload = await response.Content.ReadFromJsonAsync<DynamicApiPayload<T>>(new JsonSerializerOptions
+        {
+            PropertyNameCaseInsensitive = true
+        });
+
+        return payload ?? throw new InvalidOperationException("DynamicApi 响应为空。");
+    }
+
+    private sealed class DynamicApiPayload<T>
+    {
+        public bool Success { get; set; }
+        public T? Data { get; set; }
+    }
+}