fix(security): 外网攻击面加固 BL-01～05

收紧 PUBLIC 路径误匹配、强制 health/detail 与壁纸 sync 鉴权、默认关闭 OpenAPI；
安装锁定后 /api/install/* 统一 404；附探测脚本、测试与审计文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/settings.py

@@ -19,7 +19,7 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel, Field
 
 from server.api.dependencies import get_db
-from server.api.auth_jwt import get_current_admin
+from server.api.auth_jwt import get_current_admin, require_current_admin
 from server.api.schemas import ScheduleCreate, ScheduleUpdate, PresetCreate, PresetUpdate, SettingUpdatePayload, ApiKeyRevealRequest, SshKeyPresetCreate, SshKeyPresetUpdate
 from server.infrastructure.database.setting_repo import SettingRepositoryImpl
 from server.infrastructure.database.push_schedule_repo import PushScheduleRepositoryImpl, PushRetryJobRepositoryImpl
@@ -253,7 +253,7 @@ async def bing_wallpapers():
 
 
 @router.post("/bing-wallpapers/sync", response_model=dict)
-async def bing_wallpapers_sync(admin: Admin = Depends(get_current_admin)):
+async def bing_wallpapers_sync(admin: Admin = Depends(require_current_admin)):
     """Admin-only: fetch latest Bing images into local cache."""
     downloaded = await _sync_bing_wallpapers_from_network()
     result = _cached_wallpaper_urls()