Implement authentication and chat functionality with JWT support

- Added `auth.py` for mock login and JWT issuance.
- Introduced `chat.py` for handling chat requests with role-based access control.
- Enhanced `main.py` to include new routers and middleware for tracing.
- Implemented input validation in `input_guard.py` to prevent SQL injection.
- Created repositories for managing agent sessions and audit logs.
- Added exception handling for authorization errors.
- Updated settings to include JWT configuration.
- Introduced tests for authentication and input validation.

app/utils/input_guard.py

@@ -0,0 +1,25 @@
+"""输入防护（F-03 最小实现）。"""
+
+from __future__ import annotations
+
+import re
+
+from app.utils.exceptions import AppError
+
+_INJECTION_PATTERNS = (
+    re.compile(r"(?i)ignore\s+previous\s+instructions"),
+    re.compile(r"(?i)system\s*:\s*"),
+    re.compile(r"(?is)(drop|delete|update|insert|alter|truncate)\s+"),
+)
+
+
+def validate_user_message(message: str, *, max_len: int = 8000) -> str:
+    text = message.strip()
+    if not text:
+        raise AppError(400, "消息不能为空", error_code="INPUT_EMPTY")
+    if len(text) > max_len:
+        raise AppError(400, "消息过长", error_code="INPUT_OVERSIZE", audit_event="input_guard")
+    for pattern in _INJECTION_PATTERNS:
+        if pattern.search(text):
+            raise AppError(400, "输入包含不允许的内容", error_code="INPUT_BLOCKED", audit_event="input_guard")
+    return text