refactor: 凭证下沉账号层——平台不再持有API凭证；账号支持登录凭证+API配置，SDK测试/同步改为账号维度，同步产出自动挂账号；含存量数据自动迁移

app/services/account_service.py

@@ -2,6 +2,7 @@
 
 账号与资产的关系：Asset.account 按名称引用账号（字符串，兼容历史自由文本）。
 重命名账号时同步更新所有引用资产，保证两边一致。
+凭证层：登录密码与 API 配置加密存储，Read 仅返回布尔标记。
 """
 
 from typing import Dict, List
@@ -10,6 +11,7 @@ from fastapi import HTTPException, status
 from sqlalchemy import func
 from sqlmodel import Session, select
 
+from app.core import crypto
 from app.models.asset import Account, Asset
 from app.schemas.account import AccountCreate, AccountRead, AccountUpdate
 
@@ -27,6 +29,8 @@ def _asset_counts(session: Session) -> Dict[str, int]:
 def _to_read(account: Account, counts: Dict[str, int]) -> AccountRead:
     read = AccountRead.model_validate(account)
     read.asset_count = counts.get(account.name, 0)
+    read.has_login_password = bool(account.login_password_encrypted)
+    read.has_api_config = bool(account.api_config_encrypted)
     return read
 
 
@@ -58,7 +62,9 @@ def create_account(session: Session, data: AccountCreate) -> AccountRead:
     if not name:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="账号名称不能为空")
     _check_name_taken(session, name)
-    account = Account(name=name, platform=data.platform, remark=data.remark)
+    account = Account(name=name, platform=data.platform, remark=data.remark, login_user=data.login_user)
+    account.login_password_encrypted = crypto.encrypt(data.login_password)
+    account.api_config_encrypted = crypto.encrypt(data.api_config)
     session.add(account)
     session.commit()
     session.refresh(account)
@@ -83,6 +89,13 @@ def update_account(session: Session, account_id: int, data: AccountUpdate) -> Ac
         account.platform = data.platform or None
     if data.remark is not None:
         account.remark = data.remark or None
+    if data.login_user is not None:
+        account.login_user = data.login_user or None
+    # 凭证：None = 不修改；空串 = 清除；非空 = 重新加密存储
+    if data.login_password is not None:
+        account.login_password_encrypted = crypto.encrypt(data.login_password)
+    if data.api_config is not None:
+        account.api_config_encrypted = crypto.encrypt(data.api_config)
     session.add(account)
     session.commit()
     session.refresh(account)