docs(security): 建立高價值配置控管清冊 [skip ci]

apps/api/src/api/v1/monitoring.py

@@ -39,15 +39,16 @@ async def _probe_grafana(client: httpx.AsyncClient) -> dict:
         if r.status_code == 200:
             data = r.json()
             version = data.get("version")
-            # Dashboard count requires basic auth (internal probe only)
-            import base64 as _b64
-            _token = _b64.b64encode(b"admin:WoooTech2026").decode()
-            dash_r = await client.get(
-                f"{base}/api/search?type=dash-db",
-                headers={"Authorization": f"Basic {_token}"},
-                timeout=TIMEOUT,
-            )
-            dash_count = len(dash_r.json()) if dash_r.status_code == 200 and isinstance(dash_r.json(), list) else None
+            dash_count = None
+            grafana_api_key = settings.GRAFANA_API_KEY.strip()
+            if grafana_api_key and grafana_api_key != "CHANGE_ME":
+                dash_r = await client.get(
+                    f"{base}/api/search?type=dash-db",
+                    headers={"Authorization": f"Bearer {grafana_api_key}"},
+                    timeout=TIMEOUT,
+                )
+                if dash_r.status_code == 200 and isinstance(dash_r.json(), list):
+                    dash_count = len(dash_r.json())
             return {
                 "name": "Grafana",
                 "status": "up",

apps/api/src/services/ssh_command_whitelist.py

@@ -97,7 +97,7 @@ def extract_inner_command(ssh_cmd: str) -> str:
 
     範例：
         "ssh 192.168.1.1 'uptime'" → "uptime"
-        "ssh -o StrictHostKeyChecking=no host 'free -m'" → "free -m"
+        "ssh -o StrictHostKeyChecking=accept-new host 'free -m'" → "free -m"
 
     Args:
         ssh_cmd: 完整 SSH 指令字串

apps/api/tests/test_operation_parser_ssh.py

@@ -29,7 +29,7 @@ class TestSSHRecognition:
 
     def test_ssh_with_options(self):
         p = parse_operation_from_action(
-            "ssh -o StrictHostKeyChecking=no wooo@192.168.0.188 'systemctl restart ollama'"
+            "ssh -o StrictHostKeyChecking=accept-new wooo@192.168.0.188 'systemctl restart ollama'"
         )
         assert p.operation_type == OperationType.SSH_HOST
         assert p.resource_name == "192.168.0.188"