fix(btpanel): API 签名改为 md5(time+token)

与面板 common.py 一致；原双重 md5 导致密钥校验失败。

Co-authored-by: Cursor <cursoragent@cursor.com>

server/infrastructure/btpanel/client.py

@@ -33,8 +33,8 @@ class BtPanelClient:
 
     def _sign(self) -> dict[str, int | str]:
         now = int(time.time())
-        key_md5 = hashlib.md5(self.creds.api_key.encode()).hexdigest()  # nosec B324 — 宝塔 API 协议要求
-        token = hashlib.md5(f"{now}{key_md5}".encode()).hexdigest()  # nosec B324 — 宝塔 API 协议要求
+        # 宝塔 common.py: md5(request_time + api_token)，非 md5(token) 后再签
+        token = hashlib.md5(f"{now}{self.creds.api_key}".encode()).hexdigest()  # nosec B324
         return {"request_time": now, "request_token": token}
 
     def _cookie_key(self) -> str:

tests/test_btpanel_client.py

@@ -15,11 +15,10 @@ from server.infrastructure.btpanel.credentials import (
 from server.domain.models import Server
 
 
-def test_sign_algorithm_matches_official_demo():
+def test_sign_algorithm_matches_panel_common():
     api_key = "test-api-key"
     now = 1700000000
-    key_md5 = hashlib.md5(api_key.encode()).hexdigest()
-    expected = hashlib.md5(f"{now}{key_md5}".encode()).hexdigest()
+    expected = hashlib.md5(f"{now}{api_key}".encode()).hexdigest()
 
     creds = BtPanelCredentials(base_url="http://127.0.0.1:8888", api_key=api_key)
     client = BtPanelClient(creds, server_id=1)