feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

安全（P0）
- 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签
  （ywxapp.framework_package_verify，默认开启）
- JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive
- 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php）
- 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）

addon/articles/view/backend/article/edit.html

@@ -31,10 +31,23 @@
         <div class="layui-form-item">
           <label class="layui-form-label">封面图</label>
           <div class="layui-input-block">
-            <input type="text" name="cover_image" id="cover_image" value="{$article.cover_image|default=''}" class="layui-input">
+            <input type="text" name="cover_image" id="cover_image" value="{$article.cover_image|default=''}" class="layui-input" style="width:calc(100% - 120px);display:inline-block;" placeholder="图片地址，或点右侧上传">
+            <button type="button" class="layui-btn layui-btn-primary" id="cover_upload">上传</button>
+            <div style="margin-top:8px;">
+              <img id="cover_preview" src="{$article.cover_image|default=''}" alt="封面预览" style="max-height:120px;{if condition="empty($article['cover_image'])"}display:none;{/if}">
+            </div>
           </div>
         </div>
 
+        <div class="layui-form-item">
+          <label class="layui-form-label">定时发布</label>
+          <div class="layui-input-inline">
+            <input type="text" name="publish_time" id="publish_time" class="layui-input" placeholder="留空=立即发布"
+                   value="{if isset($article['publish_time']) && $article['publish_time']}{:date('Y-m-d H:i', $article['publish_time'])}{/if}">
+          </div>
+          <div class="layui-form-mid layui-word-aux">到点后自动对前台可见（状态须为「发布」）</div>
+        </div>
+
         <div class="layui-form-item">
           <label class="layui-form-label">摘要</label>
           <div class="layui-input-block">
@@ -66,7 +79,7 @@
         <div class="layui-form-item">
           <div class="layui-input-block">
             <button class="layui-btn" lay-submit lay-filter="save">保存</button>
-            <a href="{:url('articles/backend.article/index')}" class="layui-btn layui-btn-primary">返回</a>
+            <a href="{:url('articles/backend/article/index')}" class="layui-btn layui-btn-primary">返回</a>
           </div>
         </div>
       </form>
@@ -77,8 +90,41 @@
 <script src="/assets/library/ueditor/ueditor.config.js"></script>
 <script src="/assets/library/ueditor/ueditor.all.js"></script>
 <script>
-layui.use(['form', 'jquery'], function () {
-  var form = layui.form, $ = layui.jquery;
+layui.use(['form', 'jquery', 'upload', 'laydate', 'http', 'ywxapp'], function () {
+  var http = layui.http;
+  var form = layui.form, $ = layui.jquery, upload = layui.upload, laydate = layui.laydate;
+
+  laydate.render({ elem: '#publish_time', type: 'datetime' });
+
+  // 封面图上传：对接框架通用上传接口 /upload（字段名 file）
+  upload.render({
+    elem: '#cover_upload',
+    url: '/upload',
+    field: 'file',
+    accept: 'images',
+    acceptMime: 'image/*',
+    exts: 'jpg|jpeg|png|gif|webp',
+    size: 2048,
+    data: { type: 'articles' },
+    done: function (r) {
+      if (String(r.code) !== '0') {
+        layer.msg(r.message || r.msg || '上传失败');
+        return;
+      }
+      var d = r.data || {};
+      // 兼容不同驱动返回的字段名
+      var url = d.url || d.path || d.src || (typeof d === 'string' ? d : '');
+      if (!url) {
+        layer.msg('上传成功但未返回地址');
+        return;
+      }
+      $('#cover_image').val(url);
+      $('#cover_preview').attr('src', url).show();
+    },
+    error: function () {
+      layer.msg('上传失败');
+    }
+  });
 
   var ue = UE.getEditor('editor', {
     UEDITOR_HOME_URL: '/assets/library/ueditor/',
@@ -91,16 +137,10 @@ layui.use(['form', 'jquery'], function () {
 
   form.on('submit(save)', function (data) {
     data.field.content = ue.getContent();
-    $.ajax({
-      url: "{:url('articles/backend.article/update')}",
-      type: 'post',
-      data: data.field,
-      dataType: 'json',
-      success: function (r) {
+    http.post("{:url('articles/backend/article/update')}", data.field).then(function (r) {
         layer.msg(r.msg);
-        if (r.code) { setTimeout(function () { location.href = r.url || "{:url('articles/backend.article/index')}"; }, 800); }
-      }
-    });
+        if (r.code) { setTimeout(function () { location.href = r.url || "{:url('articles/backend/article/index')}"; }, 800); }
+      });
     return false;
   });
 });