fix(btpanel): API base_url 不含安全入口路径

宝塔 API 走 :port/system，安全入口仅用于浏览器登录；修复代理 404。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/changelog/2026-06-21-btpanel-api-json-path-fix.md

@@ -10,7 +10,8 @@ SSH bootstrap 将 API 配置写入 `/www/server/panel/data/api.json`，而宝塔
 
 ## 涉及文件
 
-- `server/infrastructure/btpanel/ssh_bootstrap.py` — `API_PATH` 改为 `panel/config/api.json`
+- `server/infrastructure/btpanel/client.py` — 签名 `md5(time+token)`
+- `server/infrastructure/btpanel/ssh_bootstrap.py` — `base_url` 不含安全入口路径
 - `tests/test_btpanel_ssh_bootstrap.py` — `exit_code=0` 回归用例（上一轮）
 
 ## 迁移 / 重启

server/application/services/btpanel_service.py

@@ -12,7 +12,6 @@ from server.domain.models import AuditLog, Server
 from server.infrastructure.btpanel.client import BtPanelApiError, BtPanelClient
 from server.infrastructure.btpanel.credentials import (
     BtPanelCredentials,
-    get_bt_panel_base_url,
     merge_bt_panel_extra,
     public_bt_panel_status,
     read_bt_panel_credentials,
@@ -406,8 +405,7 @@ class BtPanelService:
 
         if not url:
             method = "ssh"
-            panel_base = (creds.base_url if creds else None) or get_bt_panel_base_url(server)
-            url = await ssh_temp_login_url(server, base_url=panel_base)
+            url = await ssh_temp_login_url(server, base_url=None)
 
         await self.audit.create(AuditLog(
             admin_username=admin_username,

server/infrastructure/btpanel/ssh_bootstrap.py

@@ -51,8 +51,7 @@ def main():
     scheme = "https" if ssl else "http"
     host = panel_host or "127.0.0.1"
     base = f"{scheme}://{host}:{port}"
-    if admin_path and admin_path != "/":
-        base += "/" + admin_path.strip("/")
+    # API 根路径不含安全入口；浏览器登录 URL 由 ssh_login 单独探测 admin_path
     api = {}
     if os.path.isfile(API_PATH):
         try: