refactor(structure): group platform, infra, and shared packages

Reorganize internal packages into platform/infra/shared layers and update
imports, docs, and seed-count tests to match current system configs.

internal/infra/persistence/batchwriter/config.go

@@ -0,0 +1,69 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package batchwriter
+
+import (
+	"fmt"
+	"time"
+)
+
+const (
+	defaultQueueSize    = 10_000
+	defaultMaxBatchSize = 1_000
+	defaultMinBatchSize = 50
+	defaultFlushEvery   = time.Second
+)
+
+// Config controls queue capacity and flush thresholds for a Writer instance.
+type Config struct {
+	// Name identifies the writer in logs and diagnostics. Optional.
+	Name string
+
+	// QueueSize is the buffered channel capacity.
+	QueueSize int
+
+	// MaxBatchSize triggers a flush when the in-memory batch reaches this count.
+	MaxBatchSize int
+
+	// MinBatchSize is the minimum in-memory batch size for time-based flushes.
+	// Zero disables the threshold and preserves legacy interval flush behavior.
+	// When set, interval flushes below this size are skipped unless MaxFlushWait elapses.
+	MinBatchSize int
+
+	// FlushInterval is how often the worker checks whether a time-based flush should run.
+	FlushInterval time.Duration
+
+	// MaxFlushWait forces a flush of any non-empty batch once the oldest item has waited
+	// this long, even if MinBatchSize has not been reached. Zero disables the force path.
+	MaxFlushWait time.Duration
+}
+
+// DefaultConfig returns production-friendly defaults aligned with audit log batching.
+func DefaultConfig() Config {
+	return Config{
+		QueueSize:     defaultQueueSize,
+		MaxBatchSize:  defaultMaxBatchSize,
+		MinBatchSize:  defaultMinBatchSize,
+		FlushInterval: defaultFlushEvery,
+	}
+}
+
+func (c Config) validate() error {
+	if c.QueueSize <= 0 {
+		return fmt.Errorf("batchwriter: queue size must be positive")
+	}
+	if c.MaxBatchSize <= 0 {
+		return fmt.Errorf("batchwriter: max batch size must be positive")
+	}
+	if c.MinBatchSize < 0 {
+		return fmt.Errorf("batchwriter: min batch size must be non-negative")
+	}
+	if c.FlushInterval <= 0 {
+		return fmt.Errorf("batchwriter: flush interval must be positive")
+	}
+	if c.MaxFlushWait < 0 {
+		return fmt.Errorf("batchwriter: max flush wait must be non-negative")
+	}
+	return nil
+}

internal/infra/persistence/batchwriter/errs.go

@@ -0,0 +1,8 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package batchwriter
+
+import "errors"
+
+var errNilFlushFunc = errors.New("batchwriter: flush func is required")

internal/infra/persistence/batchwriter/writer.go

@@ -0,0 +1,264 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package batchwriter provides a reusable buffered batch writer for high-throughput
+// append-only sinks such as ClickHouse. Each business domain should own an independent
+// Writer instance with its own queue, flush callback, and tuning parameters.
+package batchwriter
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// FlushFunc persists a batch of queued items. It is invoked from the worker goroutine.
+type FlushFunc[T any] func(ctx context.Context, items []T) error
+
+// FlushErrorHandler is called when FlushFunc returns an error after optional retries.
+// The batch is discarded after the handler returns; the worker continues processing.
+// Handlers receive the failed items so callers can release dedup keys or re-queue.
+type FlushErrorHandler[T any] func(ctx context.Context, items []T, err error)
+
+// Stats is a point-in-time snapshot of Writer queue and failure counters.
+type Stats struct {
+	Name        string `json:"name"`
+	Depth       int    `json:"depth"`
+	Cap         int    `json:"cap"`
+	Drops       int64  `json:"drops"`
+	FlushErrors int64  `json:"flush_errors"`
+	Running     bool   `json:"running"`
+}
+
+// Writer buffers items and flushes them by size or interval.
+type Writer[T any] struct {
+	cfg   Config
+	flush FlushFunc[T]
+
+	onFlushError FlushErrorHandler[T]
+	onDrop       func(T)
+
+	startOnce sync.Once
+	stopOnce  sync.Once
+
+	mu        sync.RWMutex
+	ch        chan T
+	workerCtx context.Context
+	done      chan struct{}
+
+	drops       atomic.Int64
+	flushErrors atomic.Int64
+}
+
+// Option configures optional Writer callbacks.
+type Option[T any] func(*Writer[T])
+
+// WithFlushErrorHandler registers a callback for flush failures.
+func WithFlushErrorHandler[T any](handler FlushErrorHandler[T]) Option[T] {
+	return func(w *Writer[T]) {
+		w.onFlushError = handler
+	}
+}
+
+// WithDropHandler registers a callback when TryEnqueue cannot accept an item.
+func WithDropHandler[T any](handler func(T)) Option[T] {
+	return func(w *Writer[T]) {
+		w.onDrop = handler
+	}
+}
+
+// New creates a Writer. Call Start before enqueueing items.
+func New[T any](cfg Config, flush FlushFunc[T], opts ...Option[T]) (*Writer[T], error) {
+	if flush == nil {
+		return nil, errNilFlushFunc
+	}
+	if err := cfg.validate(); err != nil {
+		return nil, err
+	}
+
+	w := &Writer[T]{
+		cfg:   cfg,
+		flush: flush,
+		done:  make(chan struct{}),
+	}
+	for _, opt := range opts {
+		opt(w)
+	}
+	return w, nil
+}
+
+// Start launches the background worker. It is safe to call at most once.
+func (w *Writer[T]) Start(parent context.Context) {
+	w.startOnce.Do(func() {
+		w.mu.Lock()
+		defer w.mu.Unlock()
+
+		w.ch = make(chan T, w.cfg.QueueSize)
+		w.workerCtx = context.WithoutCancel(parent)
+		go w.run()
+	})
+}
+
+// Stop closes the queue and waits until the worker drains pending items and exits.
+func (w *Writer[T]) Stop(ctx context.Context) error {
+	w.mu.RLock()
+	ch := w.ch
+	done := w.done
+	w.mu.RUnlock()
+
+	if ch == nil {
+		return nil
+	}
+
+	w.stopOnce.Do(func() {
+		close(ch)
+	})
+
+	select {
+	case <-done:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// Running reports whether Start has been called and Stop has not completed.
+func (w *Writer[T]) Running() bool {
+	w.mu.RLock()
+	defer w.mu.RUnlock()
+	if w.ch == nil {
+		return false
+	}
+	select {
+	case <-w.done:
+		return false
+	default:
+		return true
+	}
+}
+
+// TryEnqueue adds one item without blocking. It returns false when the writer is not
+// running or the queue is full.
+func (w *Writer[T]) TryEnqueue(item T) bool {
+	w.mu.RLock()
+	ch := w.ch
+	w.mu.RUnlock()
+	if ch == nil {
+		w.notifyDrop(item)
+		return false
+	}
+
+	select {
+	case ch <- item:
+		return true
+	default:
+		w.notifyDrop(item)
+		return false
+	}
+}
+
+// IsFull reports whether the queue has no remaining capacity.
+func (w *Writer[T]) IsFull() bool {
+	w.mu.RLock()
+	defer w.mu.RUnlock()
+	if w.ch == nil {
+		return false
+	}
+	return len(w.ch) >= cap(w.ch)
+}
+
+// Len returns the current queue depth.
+func (w *Writer[T]) Len() int {
+	w.mu.RLock()
+	defer w.mu.RUnlock()
+	if w.ch == nil {
+		return 0
+	}
+	return len(w.ch)
+}
+
+// Cap returns the queue capacity.
+func (w *Writer[T]) Cap() int {
+	return w.cfg.QueueSize
+}
+
+// Stats returns a point-in-time snapshot of queue depth and failure counters.
+func (w *Writer[T]) Stats() Stats {
+	return Stats{
+		Name:        w.cfg.Name,
+		Depth:       w.Len(),
+		Cap:         w.Cap(),
+		Drops:       w.drops.Load(),
+		FlushErrors: w.flushErrors.Load(),
+		Running:     w.Running(),
+	}
+}
+
+func (w *Writer[T]) run() {
+	ticker := time.NewTicker(w.cfg.FlushInterval)
+	defer ticker.Stop()
+
+	batch := make([]T, 0, w.cfg.MaxBatchSize)
+	var batchStartedAt time.Time
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		items := append([]T(nil), batch...)
+		if err := w.flush(w.workerCtx, items); err != nil {
+			w.flushErrors.Add(1)
+			if w.onFlushError != nil {
+				w.onFlushError(w.workerCtx, items, err)
+			}
+		}
+		batch = batch[:0]
+		batchStartedAt = time.Time{}
+	}
+
+	defer func() {
+		flush()
+		close(w.done)
+	}()
+
+	for {
+		select {
+		case item, ok := <-w.ch:
+			if !ok {
+				return
+			}
+			if len(batch) == 0 {
+				batchStartedAt = time.Now()
+			}
+			batch = append(batch, item)
+			if len(batch) >= w.cfg.MaxBatchSize {
+				flush()
+			}
+		case <-ticker.C:
+			if w.shouldFlushOnInterval(len(batch), batchStartedAt, time.Now()) {
+				flush()
+			}
+		}
+	}
+}
+
+func (w *Writer[T]) shouldFlushOnInterval(batchLen int, batchStartedAt time.Time, now time.Time) bool {
+	if batchLen == 0 {
+		return false
+	}
+	if w.cfg.MinBatchSize == 0 || batchLen >= w.cfg.MinBatchSize {
+		return true
+	}
+	if w.cfg.MaxFlushWait <= 0 || batchStartedAt.IsZero() {
+		return false
+	}
+	return !now.Before(batchStartedAt.Add(w.cfg.MaxFlushWait))
+}
+
+func (w *Writer[T]) notifyDrop(item T) {
+	w.drops.Add(1)
+	if w.onDrop == nil {
+		return
+	}
+	w.onDrop(item)
+}

internal/infra/persistence/batchwriter/writer_test.go

@@ -0,0 +1,495 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package batchwriter
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestNewRejectsInvalidConfig(t *testing.T) {
+	t.Parallel()
+
+	_, err := New[int](Config{}, func(context.Context, []int) error { return nil })
+	if err == nil {
+		t.Fatal("New() = nil, want validation error")
+	}
+}
+
+func TestNewRejectsNilFlushFunc(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	_, err := New[int](cfg, nil)
+	if !errors.Is(err, errNilFlushFunc) {
+		t.Fatalf("New() error = %v, want %v", err, errNilFlushFunc)
+	}
+}
+
+func TestWriterFlushesOnMaxBatchSize(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu      sync.Mutex
+		batches [][]int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 3
+	cfg.FlushInterval = time.Hour
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batches = append(batches, append([]int(nil), items...))
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	for i := range 3 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batches) == 1
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batches
+	mu.Unlock()
+
+	want := [][]int{{1, 2, 3}}
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Fatalf("flush batches mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterFlushesOnInterval(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 0
+	cfg.FlushInterval = 20 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	if !writer.TryEnqueue(42) {
+		t.Fatal("TryEnqueue() = false, want true")
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batch) == 1
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+
+	want := []int{42}
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Fatalf("interval flush mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterTryEnqueueDropsWhenFull(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.QueueSize = 1
+	cfg.MaxBatchSize = 10
+	cfg.FlushInterval = time.Hour
+
+	var dropped int
+	writer, err := New[int](cfg, func(context.Context, []int) error { return nil }, WithDropHandler[int](func(int) {
+		dropped++
+	}))
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = writer.Stop(stopCtx)
+	})
+
+	if !writer.TryEnqueue(1) {
+		t.Fatal("TryEnqueue(1) = false, want true")
+	}
+	if writer.TryEnqueue(2) {
+		t.Fatal("TryEnqueue(2) = true, want false")
+	}
+	if !writer.IsFull() {
+		t.Fatal("IsFull() = false, want true")
+	}
+	if dropped != 1 {
+		t.Fatalf("dropped = %d, want 1", dropped)
+	}
+}
+
+func TestWriterStopDrainsQueuedItems(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 10
+	cfg.FlushInterval = time.Hour
+
+	var flushed []int
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		flushed = append(flushed, items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	for i := range 2 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := writer.Stop(stopCtx); err != nil {
+		t.Fatalf("Stop() error = %v", err)
+	}
+
+	want := []int{1, 2}
+	if diff := cmp.Diff(want, flushed); diff != "" {
+		t.Fatalf("Stop() drain mismatch (-want +got):\n%s", diff)
+	}
+	if writer.Running() {
+		t.Fatal("Running() = true after Stop(), want false")
+	}
+}
+
+func TestWriterSkipsIntervalFlushBelowMinBatchSize(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 5
+	cfg.FlushInterval = 20 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	for i := range 3 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+
+	if len(got) != 0 {
+		t.Fatalf("interval flush with below-min batch = %v, want no flush", got)
+	}
+}
+
+func TestWriterFlushesOnIntervalWhenMinBatchSizeReached(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 3
+	cfg.FlushInterval = 20 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	for i := range 3 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batch) == 3
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+
+	want := []int{1, 2, 3}
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Fatalf("interval flush at min batch size mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterForcesFlushAfterMaxFlushWait(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 50
+	cfg.FlushInterval = 20 * time.Millisecond
+	cfg.MaxFlushWait = 80 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	if !writer.TryEnqueue(1) {
+		t.Fatal("TryEnqueue(1) = false, want true")
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batch) == 1
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+	if diff := cmp.Diff([]int{1}, got); diff != "" {
+		t.Fatalf("max flush wait mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterInvokesFlushErrorHandler(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.Name = "test-flush-err"
+	cfg.MaxBatchSize = 1
+	cfg.FlushInterval = time.Hour
+
+	flushErr := errors.New("flush failed")
+	var (
+		mu       sync.Mutex
+		errCount int
+		gotItems []int
+	)
+
+	writer, err := New[int](cfg, func(context.Context, []int) error {
+		return flushErr
+	}, WithFlushErrorHandler[int](func(_ context.Context, items []int, err error) {
+		mu.Lock()
+		defer mu.Unlock()
+		errCount++
+		gotItems = append([]int(nil), items...)
+		if !errors.Is(err, flushErr) {
+			t.Errorf("flush error = %v, want %v", err, flushErr)
+		}
+	}))
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = writer.Stop(stopCtx)
+	})
+
+	if !writer.TryEnqueue(7) {
+		t.Fatal("TryEnqueue() = false, want true")
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := errCount == 1
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	gotCount := errCount
+	items := gotItems
+	mu.Unlock()
+
+	if gotCount != 1 {
+		t.Fatalf("flush error handler count = %d, want 1", gotCount)
+	}
+	if diff := cmp.Diff([]int{7}, items); diff != "" {
+		t.Fatalf("flush error handler items mismatch (-want +got):\n%s", diff)
+	}
+
+	stats := writer.Stats()
+	if stats.FlushErrors != 1 {
+		t.Fatalf("Stats().FlushErrors = %d, want 1", stats.FlushErrors)
+	}
+	if stats.Name != "test-flush-err" {
+		t.Fatalf("Stats().Name = %q, want test-flush-err", stats.Name)
+	}
+}
+
+func TestWriterStatsTracksDrops(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.Name = "test-drops"
+	cfg.QueueSize = 1
+	cfg.MaxBatchSize = 10
+	cfg.FlushInterval = time.Hour
+
+	writer, err := New[int](cfg, func(context.Context, []int) error { return nil })
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = writer.Stop(stopCtx)
+	})
+
+	if !writer.TryEnqueue(1) {
+		t.Fatal("TryEnqueue(1) = false, want true")
+	}
+	if writer.TryEnqueue(2) {
+		t.Fatal("TryEnqueue(2) = true, want false")
+	}
+
+	stats := writer.Stats()
+	if stats.Drops != 1 {
+		t.Fatalf("Stats().Drops = %d, want 1", stats.Drops)
+	}
+	if stats.Cap != 1 {
+		t.Fatalf("Stats().Cap = %d, want 1", stats.Cap)
+	}
+	if !stats.Running {
+		t.Fatal("Stats().Running = false, want true")
+	}
+}

internal/infra/persistence/clickhouse.go

@@ -0,0 +1,102 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package db 提供数据库连接与基础设施
+package db
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/ClickHouse/clickhouse-go/v2"
+	"github.com/ClickHouse/clickhouse-go/v2/lib/driver"
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
+)
+
+const (
+	clickhouseMaxExecTime       = 60 // ClickHouse 最大执行时间（秒）
+	clickhouseReadTimeoutFactor = 2  // ReadTimeout 为 DialTimeout 的倍数
+
+	// async_insert 仅挂在运行时 ChConn（写路径）上，不进入 migrator OpenDB：
+	// 迁移/DDL 需要同步可见结果，且不应走异步 insert 缓冲。
+	//
+	// 为何启用：batchwriter 仍可能在短间隔内写出相对小的块；服务端 async_insert
+	// 把多次 INSERT 合并成更大 part，减轻 3c6g 上 background merge 的 CPU 压力。
+	// wait_for_async_insert=1：调用方在 flush 返回前等待落盘，避免进程崩溃丢批。
+	// max_data_size / busy_timeout：约 10MB 或 ~2s 触发刷出，在延迟与 part 数之间折中。
+	clickhouseAsyncInsertMaxDataSize   = 10_000_000
+	clickhouseAsyncInsertBusyTimeoutMs = 2000
+)
+
+var (
+	// ChConn ClickHouse 原生连接实例，用于批量写入与查询
+	ChConn driver.Conn
+)
+
+func init() {
+	if !config.Config.ClickHouse.Enabled {
+		return
+	}
+
+	cfg := config.Config.ClickHouse
+	if cfg.Database == "" {
+		log.Fatalf("[ClickHouse] database name is required (expected: openflare)\n")
+	}
+
+	opts := buildClickHouseOptions()
+
+	var err error
+	ChConn, err = clickhouse.Open(opts)
+	if err != nil {
+		log.Fatalf("[ClickHouse] init connection failed: %v\n", err)
+	}
+
+	if err = ChConn.Ping(context.Background()); err != nil {
+		log.Fatalf("[ClickHouse] ping failed: %v\n", err)
+	}
+
+	log.Println("[ClickHouse] connection established successfully")
+}
+
+// buildClickHouseOptions builds the runtime native client options (queries + batch inserts).
+// Migrator uses a separate clickhouse.OpenDB path without async_insert settings.
+func buildClickHouseOptions() *clickhouse.Options {
+	cfg := config.Config.ClickHouse
+
+	return &clickhouse.Options{
+		Addr: cfg.Hosts,
+		Auth: clickhouse.Auth{
+			Database: cfg.Database,
+			Username: cfg.Username,
+			Password: cfg.Password,
+		},
+		Settings: clickhouse.Settings{
+			"max_execution_time":           clickhouseMaxExecTime,
+			"async_insert":                 1,
+			"wait_for_async_insert":        1,
+			"async_insert_max_data_size":   clickhouseAsyncInsertMaxDataSize,
+			"async_insert_busy_timeout_ms": clickhouseAsyncInsertBusyTimeoutMs,
+		},
+		Compression: &clickhouse.Compression{
+			Method: clickhouse.CompressionLZ4,
+		},
+		DialTimeout:     time.Duration(cfg.DialTimeout) * time.Second,
+		MaxOpenConns:    cfg.MaxOpenConn,
+		MaxIdleConns:    cfg.MaxIdleConn,
+		ConnMaxLifetime: time.Duration(cfg.ConnMaxLifetime) * time.Second,
+		ReadTimeout:     time.Duration(cfg.DialTimeout*clickhouseReadTimeoutFactor) * time.Second,
+		BlockBufferSize: cfg.BlockBufferSize,
+	}
+}
+
+// ChConnReady reports whether the native ClickHouse connection is initialized.
+func ChConnReady() bool {
+	return ChConn != nil
+}
+
+// SetChConnForTest sets the package-level native ClickHouse connection for testing.
+func SetChConnForTest(c driver.Conn) {
+	ChConn = c
+}

internal/infra/persistence/errs.go

@@ -0,0 +1,12 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package db
+
+const (
+	errRedisHashSetFailed    = "failed to set redis hash: %w"
+	errRedisHashDeleteFailed = "failed to delete redis hash field: %w"
+	errUnmarshalDataFailed   = "failed to unmarshal data: %w"
+	errMarshalDataFailed     = "failed to marshal data: %w"
+	errRedisKeySetFailed     = "failed to set redis key: %w"
+)

internal/infra/persistence/idgen/snowflake.go

@@ -0,0 +1,46 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package idgen 提供分布式 ID 生成器
+package idgen
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
+	"github.com/bwmarrin/snowflake"
+)
+
+// 2025-12-01 00:00:00 UTC 的毫秒时间戳
+const epoch int64 = 1764547200000
+
+const maxNegativeIDRetries = 3
+
+var node *snowflake.Node
+
+func init() {
+	snowflake.Epoch = epoch
+
+	nodeID := config.Config.App.NodeID
+	var err error
+	node, err = snowflake.NewNode(nodeID)
+	if err != nil {
+		log.Fatalf("[Snowflake] init failed: %v\n", err)
+	}
+	log.Printf("[Snowflake] initialized with node ID: %d, epoch: 2025-12-01\n", nodeID)
+}
+
+// NextUint64ID 生成下一个分布式唯一 ID。
+// 理论上不应出现负值；若出现则最多重试 maxNegativeIDRetries 次，仍失败则 panic。
+func NextUint64ID() uint64 {
+	for attempt := 1; attempt <= maxNegativeIDRetries; attempt++ {
+		id := node.Generate().Int64()
+		if id >= 0 {
+			return uint64(id)
+		}
+		log.Printf("[Snowflake] generated negative ID: %d (attempt %d/%d)", id, attempt, maxNegativeIDRetries)
+	}
+	panic(fmt.Sprintf("[Snowflake] generated negative ID after %d attempts", maxNegativeIDRetries))
+}

internal/infra/persistence/idgen/snowflake_test.go

@@ -0,0 +1,15 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package idgen
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNextUint64ID(t *testing.T) {
+	id := NextUint64ID()
+	assert.NotZero(t, id)
+}

internal/infra/persistence/migrator/clickhouse.go

@@ -0,0 +1,107 @@
+// Copyright 2025 linux.do
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package migrator
+
+import (
+	"context"
+	"database/sql"
+	"embed"
+	"io/fs"
+	"log"
+	"time"
+
+	"github.com/ClickHouse/clickhouse-go/v2"
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
+	"github.com/pressly/goose/v3"
+)
+
+const (
+	clickhouseMigrationDir      = "goose/clickhouse"
+	clickhouseGooseVersionTable = "goose_clickhouse_version"
+	clickhouseMaxExecTime       = 60
+	clickhouseReadTimeoutFactor = 2
+)
+
+// clickhouseMigrationFS contains SQL migrations under goose/clickhouse.
+//
+//go:embed goose/clickhouse/*.sql
+var clickhouseMigrationFS embed.FS
+
+// MigrateClickHouse runs goose migrations against ClickHouse when enabled.
+func MigrateClickHouse() Report {
+	if !config.Config.ClickHouse.Enabled {
+		return Report{Backend: "ClickHouse"}
+	}
+
+	cfg := config.Config.ClickHouse
+	sqlDB := clickhouse.OpenDB(&clickhouse.Options{
+		Addr: cfg.Hosts,
+		Auth: clickhouse.Auth{
+			Database: cfg.Database,
+			Username: cfg.Username,
+			Password: cfg.Password,
+		},
+		Settings: clickhouse.Settings{
+			"max_execution_time": clickhouseMaxExecTime,
+		},
+		Compression: &clickhouse.Compression{
+			Method: clickhouse.CompressionLZ4,
+		},
+		DialTimeout:     time.Duration(cfg.DialTimeout) * time.Second,
+		MaxOpenConns:    cfg.MaxOpenConn,
+		MaxIdleConns:    cfg.MaxIdleConn,
+		ConnMaxLifetime: time.Duration(cfg.ConnMaxLifetime) * time.Second,
+		ReadTimeout:     time.Duration(cfg.DialTimeout*clickhouseReadTimeoutFactor) * time.Second,
+		BlockBufferSize: cfg.BlockBufferSize,
+	})
+
+	subFS, err := fs.Sub(clickhouseMigrationFS, "goose/clickhouse")
+	if err != nil {
+		closeClickHouseDB(sqlDB)
+		log.Fatalf("[ClickHouse] get sub fs failed: %v\n", err)
+	}
+
+	provider, err := goose.NewProvider(
+		"clickhouse",
+		sqlDB,
+		subFS,
+		goose.WithTableName(clickhouseGooseVersionTable),
+		goose.WithDisableGlobalRegistry(true),
+	)
+	if err != nil {
+		closeClickHouseDB(sqlDB)
+		log.Fatalf("[ClickHouse] create goose provider failed: %v\n", err)
+	}
+	previousVersion, err := provider.GetDBVersion(context.Background())
+	if err != nil {
+		closeClickHouseDB(sqlDB)
+		log.Fatalf("[ClickHouse] get goose version failed: %v\n", err)
+	}
+
+	if _, err := provider.Up(context.Background()); err != nil {
+		closeClickHouseDB(sqlDB)
+		log.Fatalf("[ClickHouse] goose migrate failed: %v\n", err)
+	}
+	currentVersion, err := provider.GetDBVersion(context.Background())
+	if err != nil {
+		closeClickHouseDB(sqlDB)
+		log.Fatalf("[ClickHouse] get migrated goose version failed: %v\n", err)
+	}
+	closeClickHouseDB(sqlDB)
+
+	log.Println("[ClickHouse] goose migrate success")
+	return Report{
+		Backend: "ClickHouse",
+		Enabled: true,
+		Version: currentVersion,
+		Applied: currentVersion != previousVersion,
+	}
+}
+
+func closeClickHouseDB(sqlDB *sql.DB) {
+	if err := sqlDB.Close(); err != nil {
+		log.Printf("[ClickHouse] close sql db failed: %v\n", err)
+	}
+}

internal/infra/persistence/migrator/clickhouse_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package migrator
+
+import (
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
+	"github.com/pressly/goose/v3"
+)
+
+func TestClickHouseMigrationFilesEmbedded(t *testing.T) {
+	entries, err := clickhouseMigrationFS.ReadDir(clickhouseMigrationDir)
+	if err != nil {
+		t.Fatalf("ReadDir(%q) error = %v", clickhouseMigrationDir, err)
+	}
+	if len(entries) == 0 {
+		t.Fatal("expected embedded ClickHouse migrations, got none")
+	}
+
+	expected := map[string]bool{
+		"202606190001_create_user_access_logs.sql": false,
+		"202606200001_create_node_access_logs.sql": false,
+	}
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		if _, ok := expected[entry.Name()]; ok {
+			expected[entry.Name()] = true
+		}
+	}
+	for name, found := range expected {
+		if !found {
+			t.Fatalf("expected %s in embedded migrations", name)
+		}
+	}
+}
+
+func TestClickHouseGooseDialect(t *testing.T) {
+	if err := goose.SetDialect("clickhouse"); err != nil {
+		t.Fatalf("SetDialect(clickhouse) error = %v", err)
+	}
+}
+
+func TestMigrateClickHouseSkipsWhenDisabled(t *testing.T) {
+	previousEnabled := config.Config.ClickHouse.Enabled
+	config.Config.ClickHouse.Enabled = false
+	t.Cleanup(func() {
+		config.Config.ClickHouse.Enabled = previousEnabled
+	})
+
+	MigrateClickHouse()
+}

internal/infra/persistence/migrator/goose/clickhouse/202606190001_create_user_access_logs.sql

@@ -0,0 +1,21 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS w_user_access_logs
+(
+    id          UInt64,
+    user_id     UInt64,
+    path        String,
+    method      String,
+    ip          String,
+    user_agent  String,
+    headers     String,
+    status      Int32,
+    latency     Int64,
+    created_at  DateTime
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(created_at)
+ORDER BY (created_at, ip, user_id)
+SETTINGS index_granularity = 8192;
+
+-- +goose Down
+DROP TABLE IF EXISTS w_user_access_logs;

internal/infra/persistence/migrator/goose/clickhouse/202606200001_create_node_access_logs.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_node_access_logs
+(
+    id          UInt64,
+    node_id     String,
+    logged_at   DateTime64(3, 'UTC'),
+    remote_addr String,
+    region      String,
+    host        String,
+    path        String,
+    status_code Int32,
+    created_at  DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(logged_at)
+ORDER BY (node_id, logged_at, remote_addr, host, path, status_code)
+SETTINGS index_granularity = 8192;
+
+-- +goose Down
+DROP TABLE IF EXISTS of_node_access_logs;

internal/infra/persistence/migrator/goose/clickhouse/202606200002_create_node_observability_tables.sql

@@ -0,0 +1,92 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_node_metric_snapshots
+(
+    id                  UInt64,
+    node_id             String,
+    captured_at         DateTime64(3, 'UTC'),
+    cpu_usage_percent   Float64,
+    memory_used_bytes   Int64,
+    memory_total_bytes  Int64,
+    storage_used_bytes  Int64,
+    storage_total_bytes Int64,
+    disk_read_bytes     Int64,
+    disk_write_bytes    Int64,
+    network_rx_bytes    Int64,
+    network_tx_bytes    Int64,
+    created_at          DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_request_reports
+(
+    id                    UInt64,
+    node_id               String,
+    window_started_at     DateTime64(3, 'UTC'),
+    window_ended_at       DateTime64(3, 'UTC'),
+    request_count         Int64,
+    error_count           Int64,
+    unique_visitor_count  Int64,
+    status_codes_json     String,
+    top_domains_json      String,
+    source_countries_json String,
+    created_at            DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(window_ended_at)
+ORDER BY (node_id, window_ended_at, window_started_at, id)
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_obs_openresty
+(
+    id                    UInt64,
+    node_id               String,
+    captured_at           DateTime64(3, 'UTC'),
+    openresty_rx_bytes    Int64,
+    openresty_tx_bytes    Int64,
+    openresty_connections Int64,
+    created_at            DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_obs_frps
+(
+    id                 UInt64,
+    node_id            String,
+    captured_at        DateTime64(3, 'UTC'),
+    frps_connections   Int32,
+    frps_proxy_count   Int32,
+    frps_client_count  Int32,
+    frps_proxies       String,
+    created_at         DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_obs_frpc
+(
+    id                      UInt64,
+    node_id                 String,
+    captured_at             DateTime64(3, 'UTC'),
+    tunnel_status           String,
+    connected_relays_count  Int32,
+    created_at              DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+SETTINGS index_granularity = 8192;
+
+-- +goose Down
+DROP TABLE IF EXISTS of_node_obs_frpc;
+DROP TABLE IF EXISTS of_node_obs_frps;
+DROP TABLE IF EXISTS of_node_obs_openresty;
+DROP TABLE IF EXISTS of_node_request_reports;
+DROP TABLE IF EXISTS of_node_metric_snapshots;

internal/infra/persistence/migrator/goose/clickhouse/202607020001_optimize_analytics_tables.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+-- Add TTL policies to analytics tables so ClickHouse can expire rows automatically.
+ALTER TABLE w_user_access_logs MODIFY TTL created_at + INTERVAL 180 DAY;
+
+-- DateTime64 columns must be cast for TTL (ClickHouse requires DateTime/Date in TTL expr).
+ALTER TABLE of_node_access_logs MODIFY TTL toDateTime(logged_at) + INTERVAL 90 DAY;
+
+ALTER TABLE of_node_metric_snapshots MODIFY TTL toDateTime(captured_at) + INTERVAL 30 DAY;
+
+ALTER TABLE of_node_request_reports MODIFY TTL toDateTime(window_ended_at) + INTERVAL 30 DAY;
+
+ALTER TABLE of_node_obs_openresty MODIFY TTL toDateTime(captured_at) + INTERVAL 30 DAY;
+
+ALTER TABLE of_node_obs_frps MODIFY TTL toDateTime(captured_at) + INTERVAL 30 DAY;
+
+ALTER TABLE of_node_obs_frpc MODIFY TTL toDateTime(captured_at) + INTERVAL 30 DAY;
+
+-- +goose Down
+-- TTL changes cannot be safely reversed without recreating tables.

internal/infra/persistence/migrator/goose/clickhouse/202607020002_create_node_traffic_hourly_mv.sql

@@ -0,0 +1,28 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_node_traffic_hourly
+(
+    node_id               String,
+    hour                  DateTime,
+    request_count         UInt64,
+    error_count           UInt64,
+    unique_visitor_count  UInt64
+)
+ENGINE = SummingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour);
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_node_traffic_hourly_mv
+TO of_node_traffic_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(window_ended_at) AS hour,
+    sum(request_count) AS request_count,
+    sum(error_count) AS error_count,
+    sum(unique_visitor_count) AS unique_visitor_count
+FROM of_node_request_reports
+GROUP BY node_id, hour;
+
+-- +goose Down
+DROP VIEW IF EXISTS of_node_traffic_hourly_mv;
+DROP TABLE IF EXISTS of_node_traffic_hourly;

internal/infra/persistence/migrator/goose/clickhouse/202607100001_create_node_metric_openresty_hourly.sql

@@ -0,0 +1,80 @@
+-- +goose Up
+-- Hourly capacity rollups (avg CPU/memory + counter min/max for in-hour delta approximation).
+-- Network/disk counters are cumulative; max-min within an hour approximates that hour's delta
+-- (cross-hour continuity is intentionally approximate for dashboard trends).
+CREATE TABLE IF NOT EXISTS of_node_metric_capacity_hourly
+(
+    node_id              String,
+    hour                 DateTime,
+    cpu_usage_sum        SimpleAggregateFunction(sum, Float64),
+    cpu_usage_count      SimpleAggregateFunction(sum, UInt64),
+    memory_usage_sum     SimpleAggregateFunction(sum, Float64),
+    memory_usage_count   SimpleAggregateFunction(sum, UInt64),
+    network_rx_min       SimpleAggregateFunction(min, Int64),
+    network_rx_max       SimpleAggregateFunction(max, Int64),
+    network_tx_min       SimpleAggregateFunction(min, Int64),
+    network_tx_max       SimpleAggregateFunction(max, Int64),
+    disk_read_min        SimpleAggregateFunction(min, Int64),
+    disk_read_max        SimpleAggregateFunction(max, Int64),
+    disk_write_min       SimpleAggregateFunction(min, Int64),
+    disk_write_max       SimpleAggregateFunction(max, Int64)
+)
+ENGINE = AggregatingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour)
+TTL hour + INTERVAL 30 DAY;
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_node_metric_capacity_hourly_mv
+TO of_node_metric_capacity_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(captured_at) AS hour,
+    sum(cpu_usage_percent) AS cpu_usage_sum,
+    toUInt64(count()) AS cpu_usage_count,
+    sum(if(memory_total_bytes > 0, (memory_used_bytes * 100.0) / memory_total_bytes, 0)) AS memory_usage_sum,
+    toUInt64(countIf(memory_total_bytes > 0)) AS memory_usage_count,
+    min(network_rx_bytes) AS network_rx_min,
+    max(network_rx_bytes) AS network_rx_max,
+    min(network_tx_bytes) AS network_tx_min,
+    max(network_tx_bytes) AS network_tx_max,
+    min(disk_read_bytes) AS disk_read_min,
+    max(disk_read_bytes) AS disk_read_max,
+    min(disk_write_bytes) AS disk_write_min,
+    max(disk_write_bytes) AS disk_write_max
+FROM of_node_metric_snapshots
+GROUP BY node_id, hour;
+
+-- Hourly OpenResty counter rollups (min/max per node-hour for delta approximation).
+CREATE TABLE IF NOT EXISTS of_node_openresty_hourly
+(
+    node_id            String,
+    hour               DateTime,
+    openresty_rx_min   SimpleAggregateFunction(min, Int64),
+    openresty_rx_max   SimpleAggregateFunction(max, Int64),
+    openresty_tx_min   SimpleAggregateFunction(min, Int64),
+    openresty_tx_max   SimpleAggregateFunction(max, Int64)
+)
+ENGINE = AggregatingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour)
+TTL hour + INTERVAL 30 DAY;
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_node_openresty_hourly_mv
+TO of_node_openresty_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(captured_at) AS hour,
+    min(openresty_rx_bytes) AS openresty_rx_min,
+    max(openresty_rx_bytes) AS openresty_rx_max,
+    min(openresty_tx_bytes) AS openresty_tx_min,
+    max(openresty_tx_bytes) AS openresty_tx_max
+FROM of_node_obs_openresty
+GROUP BY node_id, hour;
+
+-- +goose Down
+DROP VIEW IF EXISTS of_node_openresty_hourly_mv;
+DROP TABLE IF EXISTS of_node_openresty_hourly;
+DROP VIEW IF EXISTS of_node_metric_capacity_hourly_mv;
+DROP TABLE IF EXISTS of_node_metric_capacity_hourly;

internal/infra/persistence/migrator/goose/clickhouse/202607100002_node_traffic_hourly_ttl_uv.sql

@@ -0,0 +1,42 @@
+-- +goose Up
+-- Hourly traffic rollups: 30d TTL + UV aggregation semantics.
+--
+-- unique_visitor_count on of_node_request_reports is per short report window
+-- (agent local distinct count for that window only). Summing those values in the
+-- MV (and again via SummingMergeTree part merges) invents a "true UV" number that
+-- double-counts visitors across windows. Prefer max() as a peak-window estimate;
+-- still NOT distinct visitors across the hour — UI/API must not overclaim.
+
+ALTER TABLE of_node_traffic_hourly
+    MODIFY TTL toDateTime(hour) + INTERVAL 30 DAY;
+
+DROP VIEW IF EXISTS of_node_traffic_hourly_mv;
+
+CREATE MATERIALIZED VIEW of_node_traffic_hourly_mv
+TO of_node_traffic_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(window_ended_at) AS hour,
+    sum(request_count) AS request_count,
+    sum(error_count) AS error_count,
+    -- Peak per-window UV estimate for the hour; not true cross-window distinct UV.
+    max(unique_visitor_count) AS unique_visitor_count
+FROM of_node_request_reports
+GROUP BY node_id, hour;
+
+-- +goose Down
+-- TTL reverse is not safe without table rewrite; restore prior MV definition only.
+DROP VIEW IF EXISTS of_node_traffic_hourly_mv;
+
+CREATE MATERIALIZED VIEW of_node_traffic_hourly_mv
+TO of_node_traffic_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(window_ended_at) AS hour,
+    sum(request_count) AS request_count,
+    sum(error_count) AS error_count,
+    sum(unique_visitor_count) AS unique_visitor_count
+FROM of_node_request_reports
+GROUP BY node_id, hour;

internal/infra/persistence/migrator/goose/clickhouse/202607100003_backfill_metric_openresty_hourly.sql

@@ -0,0 +1,66 @@
+-- +goose Up
+-- One-time historical backfill for hours not yet present in rollup tables.
+-- MV only ingests rows after creation; without this, 24h charts rely on raw merge forever.
+-- ANTI JOIN avoids double-counting hours already filled by the live MV.
+
+INSERT INTO of_node_metric_capacity_hourly
+SELECT
+    s.node_id,
+    toStartOfHour(s.captured_at) AS hour,
+    sum(s.cpu_usage_percent) AS cpu_usage_sum,
+    toUInt64(count()) AS cpu_usage_count,
+    sum(if(s.memory_total_bytes > 0, (s.memory_used_bytes * 100.0) / s.memory_total_bytes, 0)) AS memory_usage_sum,
+    toUInt64(countIf(s.memory_total_bytes > 0)) AS memory_usage_count,
+    min(s.network_rx_bytes) AS network_rx_min,
+    max(s.network_rx_bytes) AS network_rx_max,
+    min(s.network_tx_bytes) AS network_tx_min,
+    max(s.network_tx_bytes) AS network_tx_max,
+    min(s.disk_read_bytes) AS disk_read_min,
+    max(s.disk_read_bytes) AS disk_read_max,
+    min(s.disk_write_bytes) AS disk_write_min,
+    max(s.disk_write_bytes) AS disk_write_max
+FROM of_node_metric_snapshots AS s
+ANTI JOIN
+(
+    SELECT
+        node_id,
+        hour
+    FROM of_node_metric_capacity_hourly
+    GROUP BY
+        node_id,
+        hour
+) AS existing
+ON s.node_id = existing.node_id AND toStartOfHour(s.captured_at) = existing.hour
+WHERE s.captured_at >= now() - INTERVAL 30 DAY
+GROUP BY
+    s.node_id,
+    hour;
+
+INSERT INTO of_node_openresty_hourly
+SELECT
+    s.node_id,
+    toStartOfHour(s.captured_at) AS hour,
+    min(s.openresty_rx_bytes) AS openresty_rx_min,
+    max(s.openresty_rx_bytes) AS openresty_rx_max,
+    min(s.openresty_tx_bytes) AS openresty_tx_min,
+    max(s.openresty_tx_bytes) AS openresty_tx_max
+FROM of_node_obs_openresty AS s
+ANTI JOIN
+(
+    SELECT
+        node_id,
+        hour
+    FROM of_node_openresty_hourly
+    GROUP BY
+        node_id,
+        hour
+) AS existing
+ON s.node_id = existing.node_id AND toStartOfHour(s.captured_at) = existing.hour
+WHERE s.captured_at >= now() - INTERVAL 30 DAY
+GROUP BY
+    s.node_id,
+    hour;
+
+-- +goose Down
+-- Backfill is additive; down does not remove historical rollup rows (TTL still applies).
+SELECT 1;

internal/infra/persistence/migrator/goose/clickhouse/202607120001_add_bytes_sent_to_node_access_logs.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+ALTER TABLE of_node_access_logs ADD COLUMN IF NOT EXISTS bytes_sent UInt64;
+
+-- +goose Down
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS bytes_sent;

internal/infra/persistence/migrator/goose/clickhouse/202607180001_access_log_request_length.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+-- L1 access log: request body/header length (接收数据) and optional request duration.
+ALTER TABLE of_node_access_logs
+    ADD COLUMN IF NOT EXISTS request_length UInt64 DEFAULT 0;
+
+ALTER TABLE of_node_access_logs
+    ADD COLUMN IF NOT EXISTS request_time_ms UInt32 DEFAULT 0;
+
+-- +goose Down
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS request_time_ms;
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS request_length;

internal/infra/persistence/migrator/goose/clickhouse/202607180002_edge_health_access_log_hourly_drop_legacy.sql

@@ -0,0 +1,149 @@
+-- +goose Up
+-- M5: L2 edge health table, L1 access-log hourly rollup, drop deprecated pre-aggregation tables.
+
+CREATE TABLE IF NOT EXISTS of_node_edge_health
+(
+    id           UInt64,
+    node_id      String,
+    captured_at  DateTime64(3, 'UTC'),
+    status       LowCardinality(String),
+    connections  Int64,
+    created_at   DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+TTL toDateTime(captured_at) + INTERVAL 30 DAY
+SETTINGS index_granularity = 8192;
+
+-- Hourly business traffic from access logs (Server-side only; Agent never writes this).
+-- SummingMergeTree merges request/error/bytes; UV is not stored (query raw for exact UV).
+CREATE TABLE IF NOT EXISTS of_access_log_hourly
+(
+    node_id         String,
+    hour            DateTime('UTC'),
+    host            String,
+    request_count   UInt64,
+    error_count     UInt64,
+    bytes_sent      UInt64,
+    request_length  UInt64
+)
+ENGINE = SummingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour, host)
+TTL hour + INTERVAL 90 DAY
+SETTINGS index_granularity = 8192;
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_access_log_hourly_mv
+TO of_access_log_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(logged_at) AS hour,
+    host,
+    toUInt64(count()) AS request_count,
+    toUInt64(countIf(status_code >= 500)) AS error_count,
+    sum(bytes_sent) AS bytes_sent,
+    sum(request_length) AS request_length
+FROM of_node_access_logs
+GROUP BY node_id, hour, host;
+
+-- Deprecated pre-aggregation paths (business traffic is access logs; OR throughput is not authoritative).
+DROP VIEW IF EXISTS of_node_traffic_hourly_mv;
+DROP TABLE IF EXISTS of_node_traffic_hourly;
+DROP VIEW IF EXISTS of_node_openresty_hourly_mv;
+DROP TABLE IF EXISTS of_node_openresty_hourly;
+DROP TABLE IF EXISTS of_node_request_reports;
+DROP TABLE IF EXISTS of_node_obs_openresty;
+
+-- +goose Down
+CREATE TABLE IF NOT EXISTS of_node_obs_openresty
+(
+    id                    UInt64,
+    node_id               String,
+    captured_at           DateTime64(3, 'UTC'),
+    openresty_rx_bytes    Int64,
+    openresty_tx_bytes    Int64,
+    openresty_connections Int64,
+    created_at            DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(captured_at)
+ORDER BY (node_id, captured_at, id)
+TTL toDateTime(captured_at) + INTERVAL 30 DAY
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_request_reports
+(
+    id                    UInt64,
+    node_id               String,
+    window_started_at     DateTime64(3, 'UTC'),
+    window_ended_at       DateTime64(3, 'UTC'),
+    request_count         Int64,
+    error_count           Int64,
+    unique_visitor_count  Int64,
+    status_codes_json     String,
+    top_domains_json      String,
+    source_countries_json String,
+    created_at            DateTime64(3, 'UTC')
+)
+ENGINE = MergeTree()
+PARTITION BY toYYYYMM(window_ended_at)
+ORDER BY (node_id, window_ended_at, window_started_at, id)
+TTL toDateTime(window_ended_at) + INTERVAL 30 DAY
+SETTINGS index_granularity = 8192;
+
+CREATE TABLE IF NOT EXISTS of_node_traffic_hourly
+(
+    node_id               String,
+    hour                  DateTime,
+    request_count         UInt64,
+    error_count           UInt64,
+    unique_visitor_count  UInt64
+)
+ENGINE = SummingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour);
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_node_traffic_hourly_mv
+TO of_node_traffic_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(window_ended_at) AS hour,
+    sum(request_count) AS request_count,
+    sum(error_count) AS error_count,
+    max(unique_visitor_count) AS unique_visitor_count
+FROM of_node_request_reports
+GROUP BY node_id, hour;
+
+CREATE TABLE IF NOT EXISTS of_node_openresty_hourly
+(
+    node_id            String,
+    hour               DateTime,
+    openresty_rx_min   SimpleAggregateFunction(min, Int64),
+    openresty_rx_max   SimpleAggregateFunction(max, Int64),
+    openresty_tx_min   SimpleAggregateFunction(min, Int64),
+    openresty_tx_max   SimpleAggregateFunction(max, Int64)
+)
+ENGINE = AggregatingMergeTree()
+PARTITION BY toYYYYMM(hour)
+ORDER BY (node_id, hour)
+TTL hour + INTERVAL 30 DAY;
+
+CREATE MATERIALIZED VIEW IF NOT EXISTS of_node_openresty_hourly_mv
+TO of_node_openresty_hourly
+AS
+SELECT
+    node_id,
+    toStartOfHour(captured_at) AS hour,
+    min(openresty_rx_bytes) AS openresty_rx_min,
+    max(openresty_rx_bytes) AS openresty_rx_max,
+    min(openresty_tx_bytes) AS openresty_tx_min,
+    max(openresty_tx_bytes) AS openresty_tx_max
+FROM of_node_obs_openresty
+GROUP BY node_id, hour;
+
+DROP VIEW IF EXISTS of_access_log_hourly_mv;
+DROP TABLE IF EXISTS of_access_log_hourly;
+DROP TABLE IF EXISTS of_node_edge_health;

internal/infra/persistence/migrator/goose/clickhouse/202607180003_backfill_access_log_hourly.sql

@@ -0,0 +1,40 @@
+-- +goose Up
+-- One-time historical backfill for of_access_log_hourly.
+-- MV only ingests rows after creation; without this, 24h charts fall back to raw access logs.
+-- ANTI JOIN avoids double-counting (node_id, hour, host) already filled by the live MV.
+-- UV is intentionally NOT stored in of_access_log_hourly (SummingMergeTree counts only).
+
+INSERT INTO of_access_log_hourly
+SELECT
+    s.node_id,
+    toStartOfHour(s.logged_at) AS hour,
+    s.host,
+    toUInt64(count()) AS request_count,
+    toUInt64(countIf(s.status_code >= 500)) AS error_count,
+    sum(s.bytes_sent) AS bytes_sent,
+    sum(s.request_length) AS request_length
+FROM of_node_access_logs AS s
+ANTI JOIN
+(
+    SELECT
+        node_id,
+        hour,
+        host
+    FROM of_access_log_hourly
+    GROUP BY
+        node_id,
+        hour,
+        host
+) AS existing
+ON s.node_id = existing.node_id
+    AND toStartOfHour(s.logged_at) = existing.hour
+    AND s.host = existing.host
+WHERE s.logged_at >= now() - INTERVAL 90 DAY
+GROUP BY
+    s.node_id,
+    hour,
+    s.host;
+
+-- +goose Down
+-- Backfill is additive; down does not remove historical rollup rows (TTL still applies).
+SELECT 1;

internal/infra/persistence/migrator/goose/clickhouse/202607180004_access_log_user_agent.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE of_node_access_logs
+    ADD COLUMN IF NOT EXISTS user_agent String DEFAULT '';
+
+-- +goose Down
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS user_agent;

internal/infra/persistence/migrator/goose/clickhouse/202607180005_access_log_cache_status.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE of_node_access_logs
+    ADD COLUMN IF NOT EXISTS cache_status String DEFAULT '';
+
+-- +goose Down
+ALTER TABLE of_node_access_logs DROP COLUMN IF EXISTS cache_status;

internal/infra/persistence/migrator/goose/postgres/202606050001_bridge_legacy.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+-- Historical Wavelet→OpenFlare table rename bridge (formerly Go migration).
+-- Fresh installs and current of_* schemas need no action.
+SELECT 1;
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/postgres/202606090001_initial_schema.sql

@@ -0,0 +1,184 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS users (
+    id BIGINT PRIMARY KEY,
+    username VARCHAR(64) UNIQUE,
+    password VARCHAR(255),
+    nickname VARCHAR(255),
+    email VARCHAR(255),
+    avatar_url VARCHAR(255),
+    is_active BOOLEAN DEFAULT TRUE,
+    is_admin BOOLEAN DEFAULT FALSE,
+    bio VARCHAR(500),
+    phone VARCHAR(32),
+    gender VARCHAR(16),
+    website VARCHAR(255),
+    location VARCHAR(255),
+    last_login_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
+CREATE INDEX IF NOT EXISTS idx_users_is_active ON users (is_active);
+CREATE INDEX IF NOT EXISTS idx_users_last_login_at ON users (last_login_at);
+CREATE INDEX IF NOT EXISTS idx_users_created_at ON users (created_at);
+
+CREATE TABLE IF NOT EXISTS auth_sources (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(80) NOT NULL UNIQUE,
+    type VARCHAR(20) NOT NULL,
+    display_name VARCHAR(100),
+    is_active BOOLEAN NOT NULL DEFAULT FALSE,
+    client_id VARCHAR(255),
+    client_secret VARCHAR(1024),
+    openid_discovery_url VARCHAR(1024),
+    scopes VARCHAR(255),
+    icon_url VARCHAR(1024),
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_auth_sources_is_active ON auth_sources (is_active);
+
+CREATE TABLE IF NOT EXISTS external_accounts (
+    id BIGSERIAL PRIMARY KEY,
+    auth_source_id BIGINT,
+    user_id BIGINT NOT NULL,
+    external_id VARCHAR(255) NOT NULL,
+    external_username VARCHAR(255),
+    email VARCHAR(255),
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_external_accounts_auth_source_id ON external_accounts (auth_source_id);
+CREATE INDEX IF NOT EXISTS idx_external_accounts_user_id ON external_accounts (user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_external_accounts_source_external ON external_accounts (auth_source_id, external_id);
+
+CREATE TABLE IF NOT EXISTS system_configs (
+    key VARCHAR(64) PRIMARY KEY,
+    value TEXT NOT NULL,
+    type VARCHAR(32) NOT NULL DEFAULT 'system',
+    visibility INTEGER NOT NULL DEFAULT 0,
+    description VARCHAR(255),
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS uploads (
+    id BIGINT PRIMARY KEY,
+    user_id BIGINT NOT NULL,
+    file_name VARCHAR(255) NOT NULL,
+    file_path VARCHAR(500) NOT NULL,
+    file_size BIGINT NOT NULL,
+    mime_type VARCHAR(100) NOT NULL,
+    extension VARCHAR(50) NOT NULL,
+    hash VARCHAR(64),
+    storage_driver VARCHAR(50) NOT NULL,
+    type VARCHAR(50) NOT NULL,
+    status VARCHAR(20) NOT NULL,
+    metadata JSONB,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads (user_id);
+CREATE INDEX IF NOT EXISTS idx_uploads_file_path ON uploads (file_path);
+CREATE INDEX IF NOT EXISTS idx_uploads_hash ON uploads (hash);
+CREATE INDEX IF NOT EXISTS idx_uploads_type ON uploads (type);
+
+CREATE TABLE IF NOT EXISTS access_tokens (
+    id BIGSERIAL PRIMARY KEY,
+    user_id BIGINT NOT NULL,
+    name VARCHAR(128) NOT NULL,
+    token_hash VARCHAR(64) NOT NULL UNIQUE,
+    masked_token VARCHAR(64) NOT NULL,
+    last_used_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_access_tokens_user_id ON access_tokens (user_id);
+
+CREATE TABLE IF NOT EXISTS task_executions (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(128) NOT NULL UNIQUE,
+    task_type VARCHAR(64) NOT NULL,
+    task_name VARCHAR(128),
+    status VARCHAR(32) NOT NULL,
+    retryable BOOLEAN NOT NULL DEFAULT FALSE,
+    max_retry INTEGER NOT NULL DEFAULT 0,
+    retry_count INTEGER NOT NULL DEFAULT 0,
+    log TEXT,
+    error_message TEXT,
+    result TEXT,
+    started_at TIMESTAMPTZ,
+    finished_at TIMESTAMPTZ,
+    duration BIGINT,
+    payload TEXT,
+    triggered_by VARCHAR(32) NOT NULL DEFAULT 'system',
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_task_executions_task_type ON task_executions (task_type);
+CREATE INDEX IF NOT EXISTS idx_task_executions_status ON task_executions (status);
+CREATE INDEX IF NOT EXISTS idx_task_executions_started_at ON task_executions (started_at);
+CREATE INDEX IF NOT EXISTS idx_task_executions_created_at ON task_executions (created_at);
+
+CREATE TABLE IF NOT EXISTS templates (
+    id BIGSERIAL PRIMARY KEY,
+    key VARCHAR(80) NOT NULL UNIQUE,
+    name VARCHAR(100) NOT NULL,
+    type VARCHAR(20) NOT NULL DEFAULT 'email',
+    subject VARCHAR(255),
+    content TEXT NOT NULL,
+    description VARCHAR(255),
+    is_system BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_templates_is_system ON templates (is_system);
+CREATE INDEX IF NOT EXISTS idx_templates_created_at ON templates (created_at);
+CREATE INDEX IF NOT EXISTS idx_templates_updated_at ON templates (updated_at);
+
+INSERT INTO system_configs (key, value, type, visibility, description, created_at, updated_at) VALUES
+    ('cap_login_enabled', 'false', 'system', 1, '是否启用登录人机验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_auto_solve', 'true', 'system', 1, '打开页面后是否自动开始计算，关闭则需用户手动点击触发', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_count', '1', 'system', 0, '客户端需求解的 PoW 难题总数，默认 1，推荐 1～5', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_size', '32', 'system', 0, '人机验证盐值长度', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_difficulty', '4', 'system', 0, '人机验证 PoW 难度（目标前缀长度）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_ttl_seconds', '600', 'system', 0, '人机验证难题有效时间（秒）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_token_ttl_seconds', '1200', 'system', 0, '人机验证兑换凭证有效时间（秒）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('server_address', '', 'system', 0, '服务器地址（用于跨域源控制，不设定则允许任意源）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_host', '', 'system', 0, 'SMTP 服务器地址（例如 smtp.example.com）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_port', '587', 'system', 0, 'SMTP 端口（例如 587 或 465）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_username', '', 'system', 0, 'SMTP 账户（如 sender@example.com）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_password', '', 'system', 0, 'SMTP 访问凭证（授权码/密码）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('upload_allowed_extensions', 'jpg,png,webp', 'system', 1, '允许上传的图片扩展名（逗号分隔）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('site_name', 'OpenFlare', 'system', 1, '系统平台的展示名称', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('password_login_enabled', 'true', 'system', 1, '是否允许使用账号密码登录', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('registration_enabled', 'false', 'system', 1, '控制普通用户是否可以自主注册（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('password_register_enabled', 'false', 'system', 1, '是否允许通过密码创建本地账号', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('oidc_login_enabled', 'true', 'system', 1, '是否允许使用第三方 OIDC 认证源登录', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('max_api_keys_per_user', '5', 'business', 1, '限制每个普通用户可以创建的 API Key 最大数量', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('email_login_verification_enabled', 'false', 'system', 1, '是否开启邮箱登录验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('email_register_verification_enabled', 'false', 'system', 1, '是否开启邮箱注册验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('menu_display_config', '{}', 'system', 1, '目录显示配置（JSON 字符串，格式为 {url: enabled}）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('search_engine_indexing_enabled', 'false', 'system', 1, '是否允许搜索引擎爬取/检索该站点（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('update_upstream_repository', 'Rain-kl/OpenFlare', 'system', 0, 'GitHub Actions Release 上游仓库（owner/repo 或 GitHub 仓库地址）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('storage_config', '{"driver":"local","local":{"root":"."},"s3":{"region":"us-east-1"},"r2":{"region":"auto"},"minio":{"region":"us-east-1","path_style":true},"oss":{},"webdav":{}}', 'system', 0, '文件存储驱动及连接配置（JSON）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO users (id, username, password, nickname, avatar_url, is_active, is_admin, last_login_at, created_at, updated_at)
+VALUES (1, 'admin', '12345678', 'Administrator', '', TRUE, TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (username) DO NOTHING;
+
+INSERT INTO templates (key, name, type, subject, content, description, is_system, created_at, updated_at) VALUES
+    ('login_email', '登录验证码邮件', 'email', 'OpenFlare 登录验证码', '<h3>OpenFlare 登录验证</h3><p>您的登录验证码为：<strong>{{.Code}}</strong>，5分钟内有效，请勿将验证码泄露给他人。</p>', '用户密码登录时发送的验证码邮件模板，支持变量：{{.Code}}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('register_email', '注册验证码邮件', 'email', 'OpenFlare 注册验证码', '<h3>OpenFlare 注册验证</h3><p>您的注册验证码为：<strong>{{.Code}}</strong>，5分钟内有效，请勿泄露给他人。</p>', '用户注册时发送的验证码邮件模板，支持变量：{{.Code}}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS templates;
+DROP TABLE IF EXISTS task_executions;
+DROP TABLE IF EXISTS access_tokens;
+DROP TABLE IF EXISTS uploads;
+DROP TABLE IF EXISTS system_configs;
+DROP TABLE IF EXISTS external_accounts;
+DROP TABLE IF EXISTS auth_sources;
+DROP TABLE IF EXISTS users;

internal/infra/persistence/migrator/goose/postgres/202606100001_create_schedules.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS schedules (
+    id BIGINT PRIMARY KEY,
+    name VARCHAR(128) NOT NULL,
+    task_type VARCHAR(64) NOT NULL,
+    cron VARCHAR(64) NOT NULL,
+    payload TEXT,
+    is_active BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_schedules_is_active ON schedules (is_active);
+
+-- Seed initial cleanup task
+INSERT INTO schedules (id, name, task_type, cron, payload, is_active, created_at, updated_at)
+VALUES (1, '清理未使用上传', 'cleanup_unused_uploads', '0 */2 * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (id) DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS schedules;

internal/infra/persistence/migrator/goose/postgres/202606100002_access_token_is_admin.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+ALTER TABLE access_tokens ADD COLUMN is_admin BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- +goose Down
+ALTER TABLE access_tokens DROP COLUMN IF EXISTS is_admin;

internal/infra/persistence/migrator/goose/postgres/202606110001_remove_access_token_last_used_at.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+-- +goose StatementBegin
+ALTER TABLE access_tokens DROP COLUMN IF EXISTS last_used_at;
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE access_tokens ADD COLUMN last_used_at TIMESTAMPTZ;
+-- +goose StatementEnd

internal/infra/persistence/migrator/goose/postgres/202606110002_alter_schedules_id_auto_increment.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+-- +goose StatementBegin
+ALTER TABLE schedules ALTER COLUMN id ADD GENERATED BY DEFAULT AS IDENTITY (START WITH 100);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE schedules ALTER COLUMN id DROP IDENTITY IF EXISTS;
+-- +goose StatementEnd

internal/infra/persistence/migrator/goose/postgres/202606110003_rename_tables_to_w_prefix.sql

@@ -0,0 +1,66 @@
+-- +goose Up
+ALTER TABLE users RENAME TO w_users;
+ALTER TABLE auth_sources RENAME TO w_auth_sources;
+ALTER TABLE external_accounts RENAME TO w_external_accounts;
+ALTER TABLE system_configs RENAME TO w_system_configs;
+ALTER TABLE uploads RENAME TO w_uploads;
+ALTER TABLE access_tokens RENAME TO w_access_tokens;
+ALTER TABLE task_executions RENAME TO w_task_executions;
+ALTER TABLE templates RENAME TO w_templates;
+ALTER TABLE schedules RENAME TO w_schedules;
+
+-- Rename indexes for consistency
+ALTER INDEX IF EXISTS idx_users_email RENAME TO idx_w_users_email;
+ALTER INDEX IF EXISTS idx_users_is_active RENAME TO idx_w_users_is_active;
+ALTER INDEX IF EXISTS idx_users_last_login_at RENAME TO idx_w_users_last_login_at;
+ALTER INDEX IF EXISTS idx_users_created_at RENAME TO idx_w_users_created_at;
+ALTER INDEX IF EXISTS idx_auth_sources_is_active RENAME TO idx_w_auth_sources_is_active;
+ALTER INDEX IF EXISTS idx_external_accounts_auth_source_id RENAME TO idx_w_external_accounts_auth_source_id;
+ALTER INDEX IF EXISTS idx_external_accounts_user_id RENAME TO idx_w_external_accounts_user_id;
+ALTER INDEX IF EXISTS idx_external_accounts_source_external RENAME TO idx_w_external_accounts_source_external;
+ALTER INDEX IF EXISTS idx_uploads_user_id RENAME TO idx_w_uploads_user_id;
+ALTER INDEX IF EXISTS idx_uploads_file_path RENAME TO idx_w_uploads_file_path;
+ALTER INDEX IF EXISTS idx_uploads_hash RENAME TO idx_w_uploads_hash;
+ALTER INDEX IF EXISTS idx_uploads_type RENAME TO idx_w_uploads_type;
+ALTER INDEX IF EXISTS idx_access_tokens_user_id RENAME TO idx_w_access_tokens_user_id;
+ALTER INDEX IF EXISTS idx_task_executions_task_type RENAME TO idx_w_task_executions_task_type;
+ALTER INDEX IF EXISTS idx_task_executions_status RENAME TO idx_w_task_executions_status;
+ALTER INDEX IF EXISTS idx_task_executions_started_at RENAME TO idx_w_task_executions_started_at;
+ALTER INDEX IF EXISTS idx_task_executions_created_at RENAME TO idx_w_task_executions_created_at;
+ALTER INDEX IF EXISTS idx_templates_is_system RENAME TO idx_w_templates_is_system;
+ALTER INDEX IF EXISTS idx_templates_created_at RENAME TO idx_w_templates_created_at;
+ALTER INDEX IF EXISTS idx_templates_updated_at RENAME TO idx_w_templates_updated_at;
+ALTER INDEX IF EXISTS idx_schedules_is_active RENAME TO idx_w_schedules_is_active;
+
+-- +goose Down
+ALTER INDEX IF EXISTS idx_w_schedules_is_active RENAME TO idx_schedules_is_active;
+ALTER INDEX IF EXISTS idx_w_templates_updated_at RENAME TO idx_templates_updated_at;
+ALTER INDEX IF EXISTS idx_w_templates_created_at RENAME TO idx_templates_created_at;
+ALTER INDEX IF EXISTS idx_w_templates_is_system RENAME TO idx_templates_is_system;
+ALTER INDEX IF EXISTS idx_w_task_executions_created_at RENAME TO idx_task_executions_created_at;
+ALTER INDEX IF EXISTS idx_w_task_executions_started_at RENAME TO idx_task_executions_started_at;
+ALTER INDEX IF EXISTS idx_w_task_executions_status RENAME TO idx_task_executions_status;
+ALTER INDEX IF EXISTS idx_w_task_executions_task_type RENAME TO idx_task_executions_task_type;
+ALTER INDEX IF EXISTS idx_w_access_tokens_user_id RENAME TO idx_access_tokens_user_id;
+ALTER INDEX IF EXISTS idx_w_uploads_type RENAME TO idx_uploads_type;
+ALTER INDEX IF EXISTS idx_w_uploads_hash RENAME TO idx_uploads_hash;
+ALTER INDEX IF EXISTS idx_w_uploads_file_path RENAME TO idx_uploads_file_path;
+ALTER INDEX IF EXISTS idx_w_uploads_user_id RENAME TO idx_uploads_user_id;
+ALTER INDEX IF EXISTS idx_w_external_accounts_source_external RENAME TO idx_external_accounts_source_external;
+ALTER INDEX IF EXISTS idx_w_external_accounts_user_id RENAME TO idx_external_accounts_user_id;
+ALTER INDEX IF EXISTS idx_w_external_accounts_auth_source_id RENAME TO idx_external_accounts_auth_source_id;
+ALTER INDEX IF EXISTS idx_w_auth_sources_is_active RENAME TO idx_auth_sources_is_active;
+ALTER INDEX IF EXISTS idx_w_users_created_at RENAME TO idx_users_created_at;
+ALTER INDEX IF EXISTS idx_w_users_last_login_at RENAME TO idx_users_last_login_at;
+ALTER INDEX IF EXISTS idx_w_users_is_active RENAME TO idx_users_is_active;
+ALTER INDEX IF EXISTS idx_w_users_email RENAME TO idx_users_email;
+
+ALTER TABLE w_schedules RENAME TO schedules;
+ALTER TABLE w_templates RENAME TO templates;
+ALTER TABLE w_task_executions RENAME TO task_executions;
+ALTER TABLE w_access_tokens RENAME TO access_tokens;
+ALTER TABLE w_uploads RENAME TO uploads;
+ALTER TABLE w_system_configs RENAME TO system_configs;
+ALTER TABLE w_external_accounts RENAME TO external_accounts;
+ALTER TABLE w_auth_sources RENAME TO auth_sources;
+ALTER TABLE w_users RENAME TO users;

internal/infra/persistence/migrator/goose/postgres/202606110004_add_file_access_whitelist_config.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES ('file_access_whitelist', '["avatar"]', 'system', 1, '免登录访问的文件业务类型白名单 (JSON 数组格式)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'file_access_whitelist';

internal/infra/persistence/migrator/goose/postgres/202606110005_add_disk_cache_configs.sql

@@ -0,0 +1,10 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES 
+  ('disk_cache_max_size_mb', '100', 'system', 0, '磁盘缓存最大空间大小 (MB)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('disk_cache_ttl_minutes', '60', 'system', 0, '磁盘缓存默认有效期 (分钟)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('disk_cache_lru_enabled', 'true', 'system', 0, '是否启用 LRU 淘汰机制', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key IN ('disk_cache_max_size_mb', 'disk_cache_ttl_minutes', 'disk_cache_lru_enabled');

internal/infra/persistence/migrator/goose/postgres/202606120001_add_login_session_ttl_config.sql

@@ -0,0 +1,8 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES 
+  ('login_session_ttl_hours', '0', 'system', 0, '登录会话过期时间 (小时，0表示浏览器关闭后自动退出，-1表示永不过期)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'login_session_ttl_hours';

internal/infra/persistence/migrator/goose/postgres/202606120002_add_update_upstream_repository_config.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES ('update_upstream_repository', 'Rain-kl/OpenFlare', 'system', 0, 'GitHub Actions Release 上游仓库（owner/repo 或 GitHub 仓库地址）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'update_upstream_repository';

internal/infra/persistence/migrator/goose/postgres/202606130001_add_upload_access_mode.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE w_uploads ADD COLUMN access_mode INTEGER NOT NULL DEFAULT 0;
+UPDATE w_uploads SET access_mode = 1 WHERE type = 'avatar';
+
+-- +goose Down
+ALTER TABLE w_uploads DROP COLUMN access_mode;

internal/infra/persistence/migrator/goose/postgres/202606130002_expand_system_config_value.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+ALTER TABLE w_system_configs ALTER COLUMN value TYPE TEXT;
+
+-- +goose Down
+ALTER TABLE w_system_configs ALTER COLUMN value TYPE VARCHAR(255);

internal/infra/persistence/migrator/goose/postgres/202606130003_add_storage_config.sql

@@ -0,0 +1,15 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES (
+  'storage_config',
+  '{"driver":"local","local":{"root":"."},"s3":{"region":"us-east-1"},"r2":{"region":"auto"},"minio":{"region":"us-east-1","path_style":true},"oss":{},"webdav":{}}',
+  'system',
+  0,
+  '文件存储驱动及连接配置（JSON）',
+  CURRENT_TIMESTAMP,
+  CURRENT_TIMESTAMP
+)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'storage_config';

internal/infra/persistence/migrator/goose/postgres/202606140001_create_push_tables.sql

@@ -0,0 +1,34 @@
+-- +goose Up
+CREATE TABLE w_push_events (
+    id BIGSERIAL PRIMARY KEY,
+    event_key VARCHAR(80) NOT NULL UNIQUE,
+    name VARCHAR(100) NOT NULL,
+    channels TEXT NOT NULL,
+    targets TEXT NOT NULL,
+    template TEXT NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_w_push_events_enabled ON w_push_events(enabled);
+
+CREATE TABLE w_push_histories (
+    id BIGSERIAL PRIMARY KEY,
+    event_key VARCHAR(80) NOT NULL,
+    channel VARCHAR(50) NOT NULL,
+    target VARCHAR(255) NOT NULL,
+    title VARCHAR(255) NOT NULL,
+    content TEXT NOT NULL,
+    level VARCHAR(20) NOT NULL,
+    status VARCHAR(20) NOT NULL,
+    error_msg TEXT,
+    created_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_w_push_histories_event ON w_push_histories(event_key);
+CREATE INDEX idx_w_push_histories_created ON w_push_histories(created_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS w_push_histories;
+DROP TABLE IF EXISTS w_push_events;

internal/infra/persistence/migrator/goose/postgres/202606140003_add_system_user.sql

@@ -0,0 +1,8 @@
+-- +goose Up
+INSERT INTO w_users (id, username, password, nickname, avatar_url, is_active, is_admin, last_login_at, created_at, updated_at)
+VALUES (999, 'system', '*', '系统', '', TRUE, FALSE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (username) DO NOTHING;
+SELECT setval(pg_get_serial_sequence('w_users', 'id'), COALESCE((SELECT MAX(id) FROM w_users), 1));
+
+-- +goose Down
+DELETE FROM w_users WHERE username = 'system';

internal/infra/persistence/migrator/goose/postgres/202606140004_create_push_channels.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+CREATE TABLE w_push_channels (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(80) NOT NULL UNIQUE,
+    description VARCHAR(255),
+    type VARCHAR(50) NOT NULL DEFAULT 'custom',
+    token VARCHAR(100),
+    url TEXT NOT NULL,
+    other TEXT NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_w_push_channels_name ON w_push_channels(name);
+CREATE INDEX idx_w_push_channels_enabled ON w_push_channels(enabled);
+
+-- +goose Down
+DROP TABLE IF EXISTS w_push_channels;

internal/infra/persistence/migrator/goose/postgres/202606140005_update_system_cleanup_schedule.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+UPDATE w_schedules
+SET name = '系统定期垃圾清理',
+    task_type = 'system_cleanup'
+WHERE id = 1;
+
+-- +goose Down
+UPDATE w_schedules
+SET name = '清理未使用上传',
+    task_type = 'cleanup_unused_uploads'
+WHERE id = 1;

internal/infra/persistence/migrator/goose/postgres/202606150001_add_task_type_to_push_events.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+ALTER TABLE w_push_events ADD COLUMN task_type VARCHAR(100) NOT NULL DEFAULT '';
+CREATE INDEX idx_w_push_events_task_type ON w_push_events(task_type);
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_w_push_events_task_type;
+ALTER TABLE w_push_events DROP COLUMN task_type;

internal/infra/persistence/migrator/goose/postgres/202606160001_remove_push_config.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+DELETE FROM w_system_configs WHERE key = 'push_config';
+DELETE FROM w_push_events WHERE event_key = 'admin_login';
+DELETE FROM w_system_configs WHERE key = 'push_global_token';
+
+-- +goose Down

internal/infra/persistence/migrator/goose/postgres/202606170001_add_upload_composite_indexes.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+CREATE INDEX IF NOT EXISTS idx_w_uploads_status_created_at ON w_uploads (status, created_at);
+CREATE INDEX IF NOT EXISTS idx_w_uploads_storage_driver_status ON w_uploads (storage_driver, status);
+CREATE INDEX IF NOT EXISTS idx_w_uploads_hash_file_size_status ON w_uploads (hash, file_size, status);
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_w_uploads_hash_file_size_status;
+DROP INDEX IF EXISTS idx_w_uploads_storage_driver_status;
+DROP INDEX IF EXISTS idx_w_uploads_status_created_at;

internal/infra/persistence/migrator/goose/postgres/202606170002_create_upload_stats_table.sql

@@ -0,0 +1,12 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS w_upload_stats (
+    dimension VARCHAR(32) NOT NULL,
+    stat_key VARCHAR(64) NOT NULL DEFAULT '',
+    file_count BIGINT NOT NULL DEFAULT 0,
+    file_size BIGINT NOT NULL DEFAULT 0,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (dimension, stat_key)
+);
+
+-- +goose Down
+DROP TABLE IF EXISTS w_upload_stats;

internal/infra/persistence/migrator/goose/postgres/202606170003_backfill_upload_stats.sql

@@ -0,0 +1,67 @@
+-- +goose Up
+INSERT INTO w_upload_stats (dimension, stat_key, file_count, file_size)
+SELECT 'total', '', COUNT(*), COALESCE(SUM(file_size), 0)
+FROM w_uploads
+WHERE status != 'deleted'
+ON CONFLICT (dimension, stat_key) DO UPDATE SET
+    file_count = EXCLUDED.file_count,
+    file_size = EXCLUDED.file_size,
+    updated_at = CURRENT_TIMESTAMP;
+
+INSERT INTO w_upload_stats (dimension, stat_key, file_count, file_size)
+SELECT
+    'type',
+    COALESCE(NULLIF(type, ''), 'generic'),
+    COUNT(*),
+    COALESCE(SUM(file_size), 0)
+FROM w_uploads
+WHERE status != 'deleted'
+GROUP BY COALESCE(NULLIF(type, ''), 'generic')
+ON CONFLICT (dimension, stat_key) DO UPDATE SET
+    file_count = EXCLUDED.file_count,
+    file_size = EXCLUDED.file_size,
+    updated_at = CURRENT_TIMESTAMP;
+
+INSERT INTO w_upload_stats (dimension, stat_key, file_count, file_size)
+SELECT
+    'category',
+    CASE
+        WHEN LOWER(mime_type) LIKE 'image/%'
+            OR LOWER(extension) IN ('jpg', 'jpeg', 'png', 'webp', 'gif') THEN '图片'
+        WHEN LOWER(mime_type) LIKE 'video/%' THEN '视频'
+        WHEN LOWER(mime_type) LIKE 'audio/%' THEN '音频'
+        WHEN LOWER(extension) IN ('zip', 'rar', '7z', 'tar', 'gz', 'tgz', 'bz2', 'xz')
+            OR LOWER(mime_type) LIKE '%zip%'
+            OR LOWER(mime_type) LIKE '%tar%'
+            OR LOWER(mime_type) LIKE '%gzip%' THEN '压缩包'
+        WHEN LOWER(extension) IN ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'md', 'csv', 'json', 'yaml', 'yml', 'xml')
+            OR LOWER(mime_type) LIKE 'text/%'
+            OR LOWER(mime_type) = 'application/pdf' THEN '文档'
+        ELSE '其他'
+    END,
+    COUNT(*),
+    COALESCE(SUM(file_size), 0)
+FROM w_uploads
+WHERE status != 'deleted'
+GROUP BY 2
+ON CONFLICT (dimension, stat_key) DO UPDATE SET
+    file_count = EXCLUDED.file_count,
+    file_size = EXCLUDED.file_size,
+    updated_at = CURRENT_TIMESTAMP;
+
+INSERT INTO w_upload_stats (dimension, stat_key, file_count, file_size)
+SELECT
+    'trend',
+    TO_CHAR(created_at, 'YYYY-MM-DD'),
+    COUNT(*),
+    COALESCE(SUM(file_size), 0)
+FROM w_uploads
+WHERE status != 'deleted'
+GROUP BY TO_CHAR(created_at, 'YYYY-MM-DD')
+ON CONFLICT (dimension, stat_key) DO UPDATE SET
+    file_count = EXCLUDED.file_count,
+    file_size = EXCLUDED.file_size,
+    updated_at = CURRENT_TIMESTAMP;
+
+-- +goose Down
+DELETE FROM w_upload_stats;

internal/infra/persistence/migrator/goose/postgres/202606180001_drop_upload_storage_driver.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+DROP INDEX IF EXISTS idx_w_uploads_storage_driver_status;
+ALTER TABLE w_uploads DROP COLUMN IF EXISTS storage_driver;
+
+-- +goose Down
+ALTER TABLE w_uploads ADD COLUMN IF NOT EXISTS storage_driver VARCHAR(50) NOT NULL DEFAULT 'local';
+CREATE INDEX IF NOT EXISTS idx_w_uploads_storage_driver_status ON w_uploads (storage_driver, status);

internal/infra/persistence/migrator/goose/postgres/202606190001_create_of_options.sql

@@ -0,0 +1,67 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_options (
+    key VARCHAR(128) PRIMARY KEY,
+    value TEXT NOT NULL DEFAULT ''
+);
+
+INSERT INTO of_options (key, value) VALUES
+    ('PasswordLoginEnabled', 'true'),
+    ('CapLoginEnabled', 'true'),
+    ('PasswordRegisterEnabled', 'false'),
+    ('EmailVerificationEnabled', 'false'),
+    ('GitHubOAuthEnabled', 'false'),
+    ('WeChatAuthEnabled', 'false'),
+    ('SMTPPort', '587'),
+    ('SystemName', 'OpenFlare'),
+    ('AgentHeartbeatInterval', '10000'),
+    ('AgentWebsocketUpgradeEnabled', 'true'),
+    ('NodeOfflineThreshold', '120000'),
+    ('AgentUpdateRepo', 'Rain-kl/OpenFlare'),
+    ('GeoIPProvider', 'ipinfo'),
+    ('DatabaseAutoCleanupEnabled', 'false'),
+    ('DatabaseAutoCleanupRetentionDays', '30'),
+    ('UptimeKumaEnabled', 'false'),
+    ('UptimeKumaMonitorScope', 'all'),
+    ('UptimeKumaSyncInterval', '5'),
+    ('UptimeKumaInterval', '60'),
+    ('UptimeKumaRetry', '0'),
+    ('UptimeKumaRetryInterval', '60'),
+    ('UptimeKumaTimeout', '48'),
+    ('OpenRestyDefaultServerReturnStatus', '421'),
+    ('OpenRestyWorkerProcesses', 'auto'),
+    ('OpenRestyWorkerConnections', '4096'),
+    ('OpenRestyWorkerRlimitNofile', '65535'),
+    ('OpenRestyEventsUse', 'epoll'),
+    ('OpenRestyEventsMultiAcceptEnabled', 'true'),
+    ('OpenRestyKeepaliveTimeout', '20'),
+    ('OpenRestyKeepaliveRequests', '1000'),
+    ('OpenRestyClientHeaderTimeout', '15'),
+    ('OpenRestyClientBodyTimeout', '15'),
+    ('OpenRestyClientMaxBodySize', '64m'),
+    ('OpenRestyLargeClientHeaderBuffers', '4 16k'),
+    ('OpenRestySendTimeout', '30'),
+    ('OpenRestyProxyConnectTimeout', '3'),
+    ('OpenRestyProxySendTimeout', '60'),
+    ('OpenRestyProxyReadTimeout', '60'),
+    ('OpenRestyWebsocketEnabled', 'true'),
+    ('OpenRestyHTTP3Enabled', 'true'),
+    ('OpenRestyProxyRequestBufferingEnabled', 'false'),
+    ('OpenRestyProxyBufferingEnabled', 'true'),
+    ('OpenRestyProxyBuffers', '16 16k'),
+    ('OpenRestyProxyBufferSize', '8k'),
+    ('OpenRestyProxyBusyBuffersSize', '64k'),
+    ('OpenRestyGzipEnabled', 'true'),
+    ('OpenRestyGzipMinLength', '1024'),
+    ('OpenRestyGzipCompLevel', '5'),
+    ('OpenRestyCacheEnabled', 'false'),
+    ('OpenRestyCacheLevels', '1:2'),
+    ('OpenRestyCacheInactive', '30m'),
+    ('OpenRestyCacheMaxSize', '1g'),
+    ('OpenRestyCacheKeyTemplate', '$scheme$host$request_uri'),
+    ('OpenRestyCacheLockEnabled', 'true'),
+    ('OpenRestyCacheLockTimeout', '5s'),
+    ('OpenRestyCacheUseStale', 'error timeout updating http_500 http_502 http_503 http_504')
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS of_options;

internal/infra/persistence/migrator/goose/postgres/202606190002_create_of_origins.sql

@@ -0,0 +1,13 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_origins (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    address VARCHAR(255) NOT NULL,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_origins_address ON of_origins (address);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_origins;

internal/infra/persistence/migrator/goose/postgres/202606190003_create_of_apply_logs.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+CREATE TABLE of_apply_logs (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    version VARCHAR(32) NOT NULL,
+    result VARCHAR(32) NOT NULL,
+    message TEXT,
+    checksum VARCHAR(64) NOT NULL DEFAULT '',
+    main_config_checksum VARCHAR(64) NOT NULL DEFAULT '',
+    route_config_checksum VARCHAR(64) NOT NULL DEFAULT '',
+    support_file_count INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL
+);
+
+CREATE INDEX idx_of_apply_logs_node_id ON of_apply_logs(node_id);
+CREATE INDEX idx_of_apply_logs_created_at ON of_apply_logs(created_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_apply_logs;

internal/infra/persistence/migrator/goose/postgres/202606190004_create_of_proxy_routes.sql

@@ -0,0 +1,43 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_proxy_routes (
+    id BIGSERIAL PRIMARY KEY,
+    site_name VARCHAR(255) NOT NULL DEFAULT '',
+    domain VARCHAR(255) NOT NULL,
+    domains TEXT NOT NULL DEFAULT '[]',
+    origin_id BIGINT,
+    origin_url VARCHAR(2048) NOT NULL,
+    origin_host VARCHAR(255) NOT NULL DEFAULT '',
+    upstreams TEXT NOT NULL DEFAULT '[]',
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    enable_https BOOLEAN NOT NULL DEFAULT FALSE,
+    cert_id BIGINT,
+    cert_ids TEXT NOT NULL DEFAULT '[]',
+    domain_cert_ids TEXT NOT NULL DEFAULT '[]',
+    redirect_http BOOLEAN NOT NULL DEFAULT FALSE,
+    limit_conn_per_server INTEGER NOT NULL DEFAULT 0,
+    limit_conn_per_ip INTEGER NOT NULL DEFAULT 0,
+    limit_rate VARCHAR(32) NOT NULL DEFAULT '',
+    cache_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    cache_policy VARCHAR(32) NOT NULL DEFAULT '',
+    cache_rules TEXT NOT NULL DEFAULT '[]',
+    custom_headers TEXT NOT NULL DEFAULT '[]',
+    basic_auth_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    basic_auth_username VARCHAR(255) NOT NULL DEFAULT '',
+    basic_auth_password VARCHAR(255) NOT NULL DEFAULT '',
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    upstream_type VARCHAR(32) NOT NULL DEFAULT 'direct',
+    tunnel_node_id BIGINT,
+    tunnel_target_addr VARCHAR(512) NOT NULL DEFAULT '',
+    tunnel_target_protocol VARCHAR(16) NOT NULL DEFAULT '',
+    pages_project_id BIGINT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_proxy_routes_domain ON of_proxy_routes (domain);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_proxy_routes_site_name ON of_proxy_routes (site_name);
+CREATE INDEX IF NOT EXISTS idx_of_proxy_routes_origin_id ON of_proxy_routes (origin_id);
+CREATE INDEX IF NOT EXISTS idx_of_proxy_routes_tunnel_node_id ON of_proxy_routes (tunnel_node_id);
+CREATE INDEX IF NOT EXISTS idx_of_proxy_routes_pages_project_id ON of_proxy_routes (pages_project_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_proxy_routes;

internal/infra/persistence/migrator/goose/postgres/202606190005_create_of_nodes.sql

@@ -0,0 +1,44 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_nodes (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    name VARCHAR(128) NOT NULL,
+    ip VARCHAR(64) NOT NULL DEFAULT '',
+    ip_manual_override BOOLEAN NOT NULL DEFAULT FALSE,
+    geo_name VARCHAR(128) NOT NULL DEFAULT '',
+    geo_latitude DOUBLE PRECISION,
+    geo_longitude DOUBLE PRECISION,
+    geo_manual_override BOOLEAN NOT NULL DEFAULT FALSE,
+    access_token VARCHAR(128) NOT NULL DEFAULT '',
+    auto_update_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    update_requested BOOLEAN NOT NULL DEFAULT FALSE,
+    update_channel VARCHAR(16) NOT NULL DEFAULT 'stable',
+    update_tag VARCHAR(64) NOT NULL DEFAULT '',
+    restart_openresty_requested BOOLEAN NOT NULL DEFAULT FALSE,
+    version VARCHAR(64) NOT NULL DEFAULT '',
+    ext_version VARCHAR(64) NOT NULL DEFAULT '',
+    openresty_status VARCHAR(16) NOT NULL DEFAULT 'unknown',
+    openresty_message TEXT,
+    status VARCHAR(16) NOT NULL DEFAULT 'offline',
+    current_version VARCHAR(32) NOT NULL DEFAULT '',
+    last_seen_at TIMESTAMPTZ,
+    last_error TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    node_type VARCHAR(32) NOT NULL DEFAULT 'edge_node',
+    relay_bind_port INTEGER NOT NULL DEFAULT 0,
+    relay_vhost_http_port INTEGER NOT NULL DEFAULT 0,
+    relay_auth_token VARCHAR(128) NOT NULL DEFAULT '',
+    relay_agent_access_addr VARCHAR(255) NOT NULL DEFAULT '',
+    relay_client_access_addr VARCHAR(255) NOT NULL DEFAULT '',
+    relay_client_proxy_url VARCHAR(512) NOT NULL DEFAULT '',
+    capabilities_json TEXT NOT NULL DEFAULT '[]',
+    relay_status VARCHAR(16) NOT NULL DEFAULT 'unknown',
+    relay_web_server_enabled BOOLEAN NOT NULL DEFAULT FALSE
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_nodes_node_id ON of_nodes (node_id);
+CREATE INDEX IF NOT EXISTS idx_of_nodes_access_token ON of_nodes (access_token);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_nodes;

internal/infra/persistence/migrator/goose/postgres/202606190006_create_of_waf_tables.sql

@@ -0,0 +1,60 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_waf_rule_groups (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    is_global BOOLEAN NOT NULL DEFAULT FALSE,
+    block_status_code INTEGER NOT NULL DEFAULT 418,
+    block_response_body TEXT NOT NULL DEFAULT '',
+    ip_whitelist TEXT NOT NULL DEFAULT '[]',
+    ip_blacklist TEXT NOT NULL DEFAULT '[]',
+    ip_whitelist_groups TEXT NOT NULL DEFAULT '[]',
+    ip_blacklist_groups TEXT NOT NULL DEFAULT '[]',
+    country_whitelist TEXT NOT NULL DEFAULT '[]',
+    country_blacklist TEXT NOT NULL DEFAULT '[]',
+    region_whitelist TEXT NOT NULL DEFAULT '[]',
+    region_blacklist TEXT NOT NULL DEFAULT '[]',
+    pow_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    pow_config TEXT NOT NULL DEFAULT '{}',
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_of_waf_rule_groups_is_global ON of_waf_rule_groups (is_global);
+
+CREATE TABLE IF NOT EXISTS of_waf_ip_groups (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    type VARCHAR(32) NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    ip_list TEXT NOT NULL DEFAULT '[]',
+    auto_config TEXT NOT NULL DEFAULT '{}',
+    ext_ips TEXT NOT NULL DEFAULT '[]',
+    subscription_url VARCHAR(2048) NOT NULL DEFAULT '',
+    subscription_format VARCHAR(32) NOT NULL DEFAULT 'text',
+    subscription_mapping_rule VARCHAR(255) NOT NULL DEFAULT '',
+    sync_interval_minutes INTEGER NOT NULL DEFAULT 1440,
+    last_synced_at TIMESTAMPTZ,
+    next_sync_at TIMESTAMPTZ,
+    last_sync_status VARCHAR(32) NOT NULL DEFAULT '',
+    last_sync_message TEXT NOT NULL DEFAULT '',
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_of_waf_ip_groups_type ON of_waf_ip_groups (type);
+CREATE INDEX IF NOT EXISTS idx_of_waf_ip_groups_next_sync_at ON of_waf_ip_groups (next_sync_at);
+
+CREATE TABLE IF NOT EXISTS of_waf_rule_group_bindings (
+    id BIGSERIAL PRIMARY KEY,
+    rule_group_id BIGINT NOT NULL,
+    proxy_route_id BIGINT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_waf_group_route ON of_waf_rule_group_bindings (rule_group_id, proxy_route_id);
+CREATE INDEX IF NOT EXISTS idx_of_waf_rule_group_bindings_proxy_route_id ON of_waf_rule_group_bindings (proxy_route_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_waf_rule_group_bindings;
+DROP TABLE IF EXISTS of_waf_ip_groups;
+DROP TABLE IF EXISTS of_waf_rule_groups;

internal/infra/persistence/migrator/goose/postgres/202606190007_create_of_tls_tables.sql

@@ -0,0 +1,61 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_tls_certificates (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    cert_pem TEXT NOT NULL,
+    key_pem TEXT NOT NULL,
+    not_before TIMESTAMPTZ,
+    not_after TIMESTAMPTZ,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    provider VARCHAR(64) NOT NULL DEFAULT 'upload',
+    acme_account_id BIGINT NOT NULL DEFAULT 0,
+    dns_account_id BIGINT NOT NULL DEFAULT 0,
+    key_algorithm VARCHAR(32) NOT NULL DEFAULT '',
+    auto_renew BOOLEAN NOT NULL DEFAULT FALSE,
+    primary_domain VARCHAR(255) NOT NULL DEFAULT '',
+    other_domains TEXT NOT NULL DEFAULT '',
+    disable_cname BOOLEAN NOT NULL DEFAULT FALSE,
+    skip_dns BOOLEAN NOT NULL DEFAULT FALSE,
+    dns1 VARCHAR(128) NOT NULL DEFAULT '',
+    dns2 VARCHAR(128) NOT NULL DEFAULT '',
+    apply_status VARCHAR(64) NOT NULL DEFAULT 'ready',
+    apply_message TEXT NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_tls_certificates_name ON of_tls_certificates (name);
+
+CREATE TABLE IF NOT EXISTS of_managed_domains (
+    id BIGSERIAL PRIMARY KEY,
+    domain VARCHAR(255) NOT NULL,
+    cert_id BIGINT,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_managed_domains_domain ON of_managed_domains (domain);
+
+CREATE TABLE IF NOT EXISTS of_dns_accounts (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    type VARCHAR(64) NOT NULL,
+    "authorization" TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS of_acme_accounts (
+    id BIGSERIAL PRIMARY KEY,
+    email VARCHAR(255) NOT NULL DEFAULT '',
+    url VARCHAR(255) NOT NULL DEFAULT '',
+    private_key TEXT NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_managed_domains;
+DROP TABLE IF EXISTS of_tls_certificates;
+DROP TABLE IF EXISTS of_dns_accounts;
+DROP TABLE IF EXISTS of_acme_accounts;

internal/infra/persistence/migrator/goose/postgres/202606190008_create_of_config_versions.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_config_versions (
+    id BIGSERIAL PRIMARY KEY,
+    version VARCHAR(32) NOT NULL,
+    snapshot_json TEXT NOT NULL,
+    main_config TEXT NOT NULL DEFAULT '',
+    rendered_config TEXT NOT NULL,
+    support_files_json TEXT NOT NULL DEFAULT '[]',
+    checksum VARCHAR(64) NOT NULL,
+    is_active BOOLEAN NOT NULL DEFAULT FALSE,
+    created_by VARCHAR(64) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_config_versions_version ON of_config_versions (version);
+CREATE INDEX IF NOT EXISTS idx_of_config_versions_is_active ON of_config_versions (is_active);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_config_versions;

internal/infra/persistence/migrator/goose/postgres/202606190009_create_of_pages_tables.sql

@@ -0,0 +1,53 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_pages_projects (
+    id BIGSERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL,
+    slug VARCHAR(128) NOT NULL,
+    description TEXT NOT NULL DEFAULT '',
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    spa_fallback_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    spa_fallback_path VARCHAR(512) NOT NULL DEFAULT '/index.html',
+    api_proxy_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    api_proxy_path VARCHAR(255) NOT NULL DEFAULT '',
+    api_proxy_pass VARCHAR(2048) NOT NULL DEFAULT '',
+    api_proxy_rewrite VARCHAR(255) NOT NULL DEFAULT '',
+    active_deployment_id BIGINT,
+    root_dir VARCHAR(512) NOT NULL DEFAULT '',
+    entry_file VARCHAR(512) NOT NULL DEFAULT 'index.html',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_pages_projects_slug ON of_pages_projects (slug);
+CREATE INDEX IF NOT EXISTS idx_of_pages_projects_active_deployment_id ON of_pages_projects (active_deployment_id);
+
+CREATE TABLE IF NOT EXISTS of_pages_deployments (
+    id BIGSERIAL PRIMARY KEY,
+    project_id BIGINT NOT NULL,
+    deployment_number INTEGER NOT NULL,
+    checksum VARCHAR(64) NOT NULL,
+    status VARCHAR(32) NOT NULL DEFAULT 'uploaded',
+    artifact_path VARCHAR(2048) NOT NULL,
+    file_count INTEGER NOT NULL DEFAULT 0,
+    total_size BIGINT NOT NULL DEFAULT 0,
+    created_by VARCHAR(64) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    activated_at TIMESTAMPTZ
+);
+CREATE INDEX IF NOT EXISTS idx_of_pages_deployments_project_id ON of_pages_deployments (project_id);
+CREATE INDEX IF NOT EXISTS idx_of_pages_deployments_checksum ON of_pages_deployments (checksum);
+CREATE INDEX IF NOT EXISTS idx_of_pages_deployments_status ON of_pages_deployments (status);
+
+CREATE TABLE IF NOT EXISTS of_pages_deployment_files (
+    id BIGSERIAL PRIMARY KEY,
+    deployment_id BIGINT NOT NULL,
+    path VARCHAR(2048) NOT NULL,
+    size BIGINT NOT NULL DEFAULT 0,
+    checksum VARCHAR(64) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_of_pages_deployment_files_deployment_id ON of_pages_deployment_files (deployment_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_pages_deployment_files;
+DROP TABLE IF EXISTS of_pages_deployments;
+DROP TABLE IF EXISTS of_pages_projects;

internal/infra/persistence/migrator/goose/postgres/202606190010_create_of_observability_tables.sql

@@ -0,0 +1,136 @@
+-- +goose Up
+CREATE TABLE of_node_system_profiles (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    hostname VARCHAR(255) NOT NULL DEFAULT '',
+    os_name VARCHAR(128) NOT NULL DEFAULT '',
+    os_version VARCHAR(128) NOT NULL DEFAULT '',
+    kernel_version VARCHAR(128) NOT NULL DEFAULT '',
+    architecture VARCHAR(64) NOT NULL DEFAULT '',
+    cpu_model VARCHAR(255) NOT NULL DEFAULT '',
+    cpu_cores INTEGER NOT NULL DEFAULT 0,
+    total_memory_bytes BIGINT NOT NULL DEFAULT 0,
+    total_disk_bytes BIGINT NOT NULL DEFAULT 0,
+    uptime_seconds BIGINT NOT NULL DEFAULT 0,
+    reported_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE UNIQUE INDEX idx_of_node_system_profiles_node_id ON of_node_system_profiles (node_id);
+CREATE INDEX idx_of_node_system_profiles_reported_at ON of_node_system_profiles (reported_at);
+
+CREATE TABLE of_node_metric_snapshots (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    cpu_usage_percent DOUBLE PRECISION NOT NULL DEFAULT 0,
+    memory_used_bytes BIGINT NOT NULL DEFAULT 0,
+    memory_total_bytes BIGINT NOT NULL DEFAULT 0,
+    storage_used_bytes BIGINT NOT NULL DEFAULT 0,
+    storage_total_bytes BIGINT NOT NULL DEFAULT 0,
+    disk_read_bytes BIGINT NOT NULL DEFAULT 0,
+    disk_write_bytes BIGINT NOT NULL DEFAULT 0,
+    network_rx_bytes BIGINT NOT NULL DEFAULT 0,
+    network_tx_bytes BIGINT NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_metric_snapshots_node_id ON of_node_metric_snapshots (node_id);
+CREATE INDEX idx_of_node_metric_snapshots_captured_at ON of_node_metric_snapshots (captured_at);
+
+CREATE TABLE of_node_request_reports (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    window_started_at TIMESTAMPTZ NOT NULL,
+    window_ended_at TIMESTAMPTZ NOT NULL,
+    request_count BIGINT NOT NULL DEFAULT 0,
+    error_count BIGINT NOT NULL DEFAULT 0,
+    unique_visitor_count BIGINT NOT NULL DEFAULT 0,
+    status_codes_json TEXT,
+    top_domains_json TEXT,
+    source_countries_json TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_request_reports_node_id ON of_node_request_reports (node_id);
+CREATE INDEX idx_of_node_request_reports_window_started_at ON of_node_request_reports (window_started_at);
+CREATE INDEX idx_of_node_request_reports_window_ended_at ON of_node_request_reports (window_ended_at);
+
+CREATE TABLE of_node_health_events (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    event_type VARCHAR(64) NOT NULL,
+    severity VARCHAR(16) NOT NULL,
+    status VARCHAR(16) NOT NULL,
+    message TEXT,
+    first_triggered_at TIMESTAMPTZ NOT NULL,
+    last_triggered_at TIMESTAMPTZ NOT NULL,
+    reported_at TIMESTAMPTZ NOT NULL,
+    resolved_at TIMESTAMPTZ,
+    metadata_json TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_health_events_node_id ON of_node_health_events (node_id);
+CREATE INDEX idx_of_node_health_events_event_type ON of_node_health_events (event_type);
+CREATE INDEX idx_of_node_health_events_status ON of_node_health_events (status);
+CREATE INDEX idx_of_node_health_events_first_triggered_at ON of_node_health_events (first_triggered_at);
+CREATE INDEX idx_of_node_health_events_last_triggered_at ON of_node_health_events (last_triggered_at);
+CREATE INDEX idx_of_node_health_events_reported_at ON of_node_health_events (reported_at);
+CREATE INDEX idx_of_node_health_events_resolved_at ON of_node_health_events (resolved_at);
+
+CREATE TABLE of_node_obs_openresty (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    openresty_rx_bytes BIGINT NOT NULL DEFAULT 0,
+    openresty_tx_bytes BIGINT NOT NULL DEFAULT 0,
+    openresty_connections BIGINT NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_openresty_node_id ON of_node_obs_openresty (node_id);
+CREATE INDEX idx_of_node_obs_openresty_captured_at ON of_node_obs_openresty (captured_at);
+
+CREATE TABLE of_node_obs_frps (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    frps_connections INTEGER NOT NULL DEFAULT 0,
+    frps_proxy_count INTEGER NOT NULL DEFAULT 0,
+    frps_client_count INTEGER NOT NULL DEFAULT 0,
+    frps_proxies TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_frps_node_id ON of_node_obs_frps (node_id);
+CREATE INDEX idx_of_node_obs_frps_captured_at ON of_node_obs_frps (captured_at);
+
+CREATE TABLE of_node_access_logs (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    logged_at TIMESTAMPTZ NOT NULL,
+    remote_addr VARCHAR(128) NOT NULL DEFAULT '',
+    region VARCHAR(128) NOT NULL DEFAULT '',
+    host VARCHAR(255) NOT NULL DEFAULT '',
+    path VARCHAR(2048) NOT NULL DEFAULT '',
+    status_code INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_access_logs_node_id ON of_node_access_logs (node_id);
+CREATE INDEX idx_of_node_access_logs_logged_at ON of_node_access_logs (logged_at);
+CREATE INDEX idx_of_node_access_logs_remote_addr ON of_node_access_logs (remote_addr);
+CREATE INDEX idx_of_node_access_logs_host ON of_node_access_logs (host);
+CREATE INDEX idx_of_node_access_logs_status_code ON of_node_access_logs (status_code);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_node_access_logs;
+DROP TABLE IF EXISTS of_node_obs_frps;
+DROP TABLE IF EXISTS of_node_obs_openresty;
+DROP TABLE IF EXISTS of_node_health_events;
+DROP TABLE IF EXISTS of_node_request_reports;
+DROP TABLE IF EXISTS of_node_metric_snapshots;
+DROP TABLE IF EXISTS of_node_system_profiles;

internal/infra/persistence/migrator/goose/postgres/202606190011_add_of_node_access_logs_composite_index.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+CREATE INDEX IF NOT EXISTS idx_of_node_access_logs_node_id_logged_at ON of_node_access_logs (node_id, logged_at);
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_of_node_access_logs_node_id_logged_at;

internal/infra/persistence/migrator/goose/postgres/202606190012_create_of_node_obs_frpc.sql

@@ -0,0 +1,15 @@
+-- +goose Up
+CREATE TABLE of_node_obs_frpc (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    tunnel_status VARCHAR(16) NOT NULL DEFAULT '',
+    connected_relays_count INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_frpc_node_id ON of_node_obs_frpc (node_id);
+CREATE INDEX idx_of_node_obs_frpc_captured_at ON of_node_obs_frpc (captured_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_node_obs_frpc;

internal/infra/persistence/migrator/goose/postgres/202606190013_seed_openflare_schedules.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+INSERT INTO w_schedules (id, name, task_type, cron, payload, is_active, created_at, updated_at)
+VALUES
+    (101, 'OpenFlare SSL 自动续期', 'of_ssl_renew', '0 0 * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    (102, 'OpenFlare 可观测数据自动清理', 'of_database_auto_cleanup', '0 3 * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    (103, 'OpenFlare WAF IP 组同步', 'of_waf_ip_group_sync', '*/5 * * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    (104, 'OpenFlare Uptime Kuma 同步', 'of_uptime_kuma_sync', '* * * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (id) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_schedules WHERE id IN (101, 102, 103, 104);

internal/infra/persistence/migrator/goose/postgres/202606190014_add_pages_deployment_upload_id.sql

@@ -0,0 +1,14 @@
+-- +goose Up
+ALTER TABLE of_pages_deployments
+    ADD COLUMN IF NOT EXISTS upload_id BIGINT NOT NULL DEFAULT 0;
+
+CREATE INDEX IF NOT EXISTS idx_of_pages_deployments_upload_id ON of_pages_deployments (upload_id);
+
+ALTER TABLE of_pages_deployments
+    ALTER COLUMN artifact_path SET DEFAULT '';
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_of_pages_deployments_upload_id;
+
+ALTER TABLE of_pages_deployments
+    DROP COLUMN IF EXISTS upload_id;

internal/infra/persistence/migrator/goose/postgres/202606200001_rebrand_openflare_defaults.sql

@@ -0,0 +1,31 @@
+-- +goose Up
+UPDATE w_system_configs
+SET value = 'OpenFlare', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'site_name' AND value = 'Wavelet';
+
+UPDATE w_system_configs
+SET value = 'Rain-kl/OpenFlare', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'update_upstream_repository' AND value = 'Rain-kl/Wavelet';
+
+UPDATE w_templates
+SET
+    subject = REPLACE(subject, 'Wavelet', 'OpenFlare'),
+    content = REPLACE(content, 'Wavelet', 'OpenFlare'),
+    updated_at = CURRENT_TIMESTAMP
+WHERE key IN ('login_email', 'register_email');
+
+-- +goose Down
+UPDATE w_system_configs
+SET value = 'Wavelet', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'site_name' AND value = 'OpenFlare';
+
+UPDATE w_system_configs
+SET value = 'Rain-kl/Wavelet', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'update_upstream_repository' AND value = 'Rain-kl/OpenFlare';
+
+UPDATE w_templates
+SET
+    subject = REPLACE(subject, 'OpenFlare', 'Wavelet'),
+    content = REPLACE(content, 'OpenFlare', 'Wavelet'),
+    updated_at = CURRENT_TIMESTAMP
+WHERE key IN ('login_email', 'register_email');

internal/infra/persistence/migrator/goose/postgres/202606200002_update_security_defaults.sql

@@ -0,0 +1,17 @@
+-- +goose Up
+UPDATE w_system_configs
+SET value = 'false', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'registration_enabled' AND value = 'true';
+
+UPDATE w_system_configs
+SET value = 'false', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'password_register_enabled' AND value = 'true';
+
+-- +goose Down
+UPDATE w_system_configs
+SET value = 'true', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'registration_enabled' AND value = 'false';
+
+UPDATE w_system_configs
+SET value = 'true', updated_at = CURRENT_TIMESTAMP
+WHERE key = 'password_register_enabled' AND value = 'false';

internal/infra/persistence/migrator/goose/postgres/202606200003_remove_legacy_rate_limit_options.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+DELETE FROM of_options
+WHERE key IN (
+    'GlobalApiRateLimitNum',
+    'GlobalApiRateLimitDuration',
+    'GlobalWebRateLimitNum',
+    'GlobalWebRateLimitDuration',
+    'CriticalRateLimitNum',
+    'CriticalRateLimitDuration'
+);
+
+-- +goose Down
+INSERT INTO of_options (key, value) VALUES
+    ('GlobalApiRateLimitNum', '300'),
+    ('GlobalApiRateLimitDuration', '180'),
+    ('GlobalWebRateLimitNum', '300'),
+    ('GlobalWebRateLimitDuration', '180'),
+    ('CriticalRateLimitNum', '100'),
+    ('CriticalRateLimitDuration', '1200')
+ON CONFLICT (key) DO NOTHING;

internal/infra/persistence/migrator/goose/postgres/202606200004_drop_of_node_access_logs.sql

@@ -0,0 +1,28 @@
+-- +goose Up
+DROP INDEX IF EXISTS idx_of_node_access_logs_node_id_logged_at;
+DROP INDEX IF EXISTS idx_of_node_access_logs_status_code;
+DROP INDEX IF EXISTS idx_of_node_access_logs_host;
+DROP INDEX IF EXISTS idx_of_node_access_logs_remote_addr;
+DROP INDEX IF EXISTS idx_of_node_access_logs_logged_at;
+DROP INDEX IF EXISTS idx_of_node_access_logs_node_id;
+DROP TABLE IF EXISTS of_node_access_logs;
+
+-- +goose Down
+CREATE TABLE of_node_access_logs (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    logged_at TIMESTAMPTZ NOT NULL,
+    remote_addr VARCHAR(128) NOT NULL DEFAULT '',
+    region VARCHAR(128) NOT NULL DEFAULT '',
+    host VARCHAR(255) NOT NULL DEFAULT '',
+    path VARCHAR(2048) NOT NULL DEFAULT '',
+    status_code INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_access_logs_node_id ON of_node_access_logs (node_id);
+CREATE INDEX idx_of_node_access_logs_logged_at ON of_node_access_logs (logged_at);
+CREATE INDEX idx_of_node_access_logs_remote_addr ON of_node_access_logs (remote_addr);
+CREATE INDEX idx_of_node_access_logs_host ON of_node_access_logs (host);
+CREATE INDEX idx_of_node_access_logs_status_code ON of_node_access_logs (status_code);
+CREATE INDEX idx_of_node_access_logs_node_id_logged_at ON of_node_access_logs (node_id, logged_at);

internal/infra/persistence/migrator/goose/postgres/202606200005_drop_of_node_observability_timeseries.sql

@@ -0,0 +1,98 @@
+-- +goose Up
+DROP INDEX IF EXISTS idx_of_node_obs_frpc_captured_at;
+DROP INDEX IF EXISTS idx_of_node_obs_frpc_node_id;
+DROP TABLE IF EXISTS of_node_obs_frpc;
+
+DROP INDEX IF EXISTS idx_of_node_obs_frps_captured_at;
+DROP INDEX IF EXISTS idx_of_node_obs_frps_node_id;
+DROP TABLE IF EXISTS of_node_obs_frps;
+
+DROP INDEX IF EXISTS idx_of_node_obs_openresty_captured_at;
+DROP INDEX IF EXISTS idx_of_node_obs_openresty_node_id;
+DROP TABLE IF EXISTS of_node_obs_openresty;
+
+DROP INDEX IF EXISTS idx_of_node_request_reports_window_ended_at;
+DROP INDEX IF EXISTS idx_of_node_request_reports_window_started_at;
+DROP INDEX IF EXISTS idx_of_node_request_reports_node_id;
+DROP TABLE IF EXISTS of_node_request_reports;
+
+DROP INDEX IF EXISTS idx_of_node_metric_snapshots_captured_at;
+DROP INDEX IF EXISTS idx_of_node_metric_snapshots_node_id;
+DROP TABLE IF EXISTS of_node_metric_snapshots;
+
+-- +goose Down
+CREATE TABLE of_node_metric_snapshots (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    cpu_usage_percent DOUBLE PRECISION NOT NULL DEFAULT 0,
+    memory_used_bytes BIGINT NOT NULL DEFAULT 0,
+    memory_total_bytes BIGINT NOT NULL DEFAULT 0,
+    storage_used_bytes BIGINT NOT NULL DEFAULT 0,
+    storage_total_bytes BIGINT NOT NULL DEFAULT 0,
+    disk_read_bytes BIGINT NOT NULL DEFAULT 0,
+    disk_write_bytes BIGINT NOT NULL DEFAULT 0,
+    network_rx_bytes BIGINT NOT NULL DEFAULT 0,
+    network_tx_bytes BIGINT NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_metric_snapshots_node_id ON of_node_metric_snapshots (node_id);
+CREATE INDEX idx_of_node_metric_snapshots_captured_at ON of_node_metric_snapshots (captured_at);
+
+CREATE TABLE of_node_request_reports (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    window_started_at TIMESTAMPTZ NOT NULL,
+    window_ended_at TIMESTAMPTZ NOT NULL,
+    request_count BIGINT NOT NULL DEFAULT 0,
+    error_count BIGINT NOT NULL DEFAULT 0,
+    unique_visitor_count BIGINT NOT NULL DEFAULT 0,
+    status_codes_json TEXT,
+    top_domains_json TEXT,
+    source_countries_json TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_request_reports_node_id ON of_node_request_reports (node_id);
+CREATE INDEX idx_of_node_request_reports_window_started_at ON of_node_request_reports (window_started_at);
+CREATE INDEX idx_of_node_request_reports_window_ended_at ON of_node_request_reports (window_ended_at);
+
+CREATE TABLE of_node_obs_openresty (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    openresty_rx_bytes BIGINT NOT NULL DEFAULT 0,
+    openresty_tx_bytes BIGINT NOT NULL DEFAULT 0,
+    openresty_connections BIGINT NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_openresty_node_id ON of_node_obs_openresty (node_id);
+CREATE INDEX idx_of_node_obs_openresty_captured_at ON of_node_obs_openresty (captured_at);
+
+CREATE TABLE of_node_obs_frps (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    frps_connections INTEGER NOT NULL DEFAULT 0,
+    frps_proxy_count INTEGER NOT NULL DEFAULT 0,
+    frps_client_count INTEGER NOT NULL DEFAULT 0,
+    frps_proxies TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_frps_node_id ON of_node_obs_frps (node_id);
+CREATE INDEX idx_of_node_obs_frps_captured_at ON of_node_obs_frps (captured_at);
+
+CREATE TABLE of_node_obs_frpc (
+    id BIGSERIAL PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    captured_at TIMESTAMPTZ NOT NULL,
+    tunnel_status VARCHAR(16) NOT NULL DEFAULT '',
+    connected_relays_count INTEGER NOT NULL DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_of_node_obs_frpc_node_id ON of_node_obs_frpc (node_id);
+CREATE INDEX idx_of_node_obs_frpc_captured_at ON of_node_obs_frpc (captured_at);

internal/infra/persistence/migrator/goose/postgres/202606200006_migrate_legacy_data.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+-- Historical copy from legacy_* tables into of_* / w_* (formerly Go migration).
+-- Already-applied environments keep their data; new installs have no legacy_* sources.
+SELECT 1;
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/postgres/202606200007_sync_of_waf_binding_sequence.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+SELECT setval(
+    pg_get_serial_sequence('of_waf_rule_group_bindings', 'id'),
+    GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0), 1),
+    COALESCE((SELECT MAX(id) FROM of_waf_rule_group_bindings), 0) > 0
+);
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/postgres/202606220001_remove_legacy_auth_options.sql

@@ -0,0 +1,22 @@
+-- +goose Up
+DELETE FROM of_options
+WHERE key IN (
+    'GitHubOAuthEnabled',
+    'GitHubClientId',
+    'GitHubClientSecret',
+    'WeChatAuthEnabled',
+    'WeChatServerAddress',
+    'WeChatServerToken',
+    'WeChatAccountQRCodeImageURL'
+);
+
+-- +goose Down
+INSERT INTO of_options (key, value) VALUES
+    ('GitHubOAuthEnabled', 'false'),
+    ('GitHubClientId', ''),
+    ('GitHubClientSecret', ''),
+    ('WeChatAuthEnabled', 'false'),
+    ('WeChatServerAddress', ''),
+    ('WeChatServerToken', ''),
+    ('WeChatAccountQRCodeImageURL', '')
+ON CONFLICT (key) DO NOTHING;

internal/infra/persistence/migrator/goose/postgres/202606220002_remove_notice_option.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+DELETE FROM of_options WHERE key = 'Notice';
+
+-- +goose Down
+INSERT OR IGNORE INTO of_options (key, value) VALUES ('Notice', '');

internal/infra/persistence/migrator/goose/postgres/202606220003_add_frps_web_ui_config.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES 
+  ('relay_frps_web_ui_enabled', 'false', 'business', 0, '是否启用 FRPS 内置 Web 管理界面', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('relay_frps_web_ui_port', '17500', 'business', 0, 'FRPS 内置 Web 管理界面端口', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key IN ('relay_frps_web_ui_enabled', 'relay_frps_web_ui_port');

internal/infra/persistence/migrator/goose/postgres/202606220004_migrate_of_options_to_system_configs.sql

@@ -0,0 +1,347 @@
+-- +goose Up
+-- 将 of_options 配置迁移到 w_system_configs（仅迁移新配置，已存在的不重复）
+
+-- Agent 相关配置 (business, visibility=0)
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'agent_discovery_token', COALESCE(value, ''), 'business', 0, 'Agent 发现令牌'
+FROM of_options WHERE key = 'AgentDiscoveryToken'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'agent_heartbeat_interval', value, 'business', 0, 'Agent 心跳间隔（毫秒）'
+FROM of_options WHERE key = 'AgentHeartbeatInterval'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'agent_websocket_upgrade_enabled', value, 'business', 0, 'Agent WebSocket 升级开关'
+FROM of_options WHERE key = 'AgentWebsocketUpgradeEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'node_offline_threshold', value, 'business', 0, '节点离线阈值（毫秒）'
+FROM of_options WHERE key = 'NodeOfflineThreshold'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'agent_update_repo', value, 'business', 0, 'Agent 更新仓库'
+FROM of_options WHERE key = 'AgentUpdateRepo'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+-- 系统功能配置 (business, visibility=0)
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'geoip_provider', value, 'business', 0, 'GeoIP 服务商'
+FROM of_options WHERE key = 'GeoIPProvider'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'database_auto_cleanup_enabled', value, 'business', 0, '数据库自动清理开关'
+FROM of_options WHERE key = 'DatabaseAutoCleanupEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'database_auto_cleanup_retention_days', value, 'business', 0, '数据库保留天数'
+FROM of_options WHERE key = 'DatabaseAutoCleanupRetentionDays'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+-- UptimeKuma 集成配置 (business, visibility=0)
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_enabled', value, 'business', 0, 'UptimeKuma 集成开关'
+FROM of_options WHERE key = 'UptimeKumaEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_url', COALESCE(value, ''), 'business', 0, 'UptimeKuma URL'
+FROM of_options WHERE key = 'UptimeKumaUrl'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_username', COALESCE(value, ''), 'business', 0, 'UptimeKuma 用户名'
+FROM of_options WHERE key = 'UptimeKumaUsername'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_password', COALESCE(value, ''), 'business', 0, 'UptimeKuma 密码'
+FROM of_options WHERE key = 'UptimeKumaPassword'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_monitor_scope', value, 'business', 0, 'UptimeKuma 监控范围'
+FROM of_options WHERE key = 'UptimeKumaMonitorScope'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_selected_sites', COALESCE(value, ''), 'business', 0, 'UptimeKuma 选定站点'
+FROM of_options WHERE key = 'UptimeKumaSelectedSites'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_sync_interval', value, 'business', 0, 'UptimeKuma 同步间隔（分钟）'
+FROM of_options WHERE key = 'UptimeKumaSyncInterval'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_interval', value, 'business', 0, 'UptimeKuma 监控间隔（秒）'
+FROM of_options WHERE key = 'UptimeKumaInterval'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_retry', value, 'business', 0, 'UptimeKuma 重试次数'
+FROM of_options WHERE key = 'UptimeKumaRetry'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_retry_interval', value, 'business', 0, 'UptimeKuma 重试间隔（秒）'
+FROM of_options WHERE key = 'UptimeKumaRetryInterval'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'uptime_kuma_timeout', value, 'business', 0, 'UptimeKuma 超时（秒）'
+FROM of_options WHERE key = 'UptimeKumaTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+-- OpenResty 配置（全部 business 类型，visibility=0）
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_default_server_return_status', value, 'business', 0, '默认服务器返回状态码'
+FROM of_options WHERE key = 'OpenRestyDefaultServerReturnStatus'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_worker_processes', value, 'business', 0, 'Worker 进程数'
+FROM of_options WHERE key = 'OpenRestyWorkerProcesses'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_worker_connections', value, 'business', 0, 'Worker 连接数'
+FROM of_options WHERE key = 'OpenRestyWorkerConnections'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_worker_rlimit_nofile', value, 'business', 0, 'Worker 文件描述符限制'
+FROM of_options WHERE key = 'OpenRestyWorkerRlimitNofile'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_events_use', value, 'business', 0, '事件模型'
+FROM of_options WHERE key = 'OpenRestyEventsUse'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_events_multi_accept_enabled', value, 'business', 0, '多路接受开关'
+FROM of_options WHERE key = 'OpenRestyEventsMultiAcceptEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_keepalive_timeout', value, 'business', 0, 'Keepalive 超时（秒）'
+FROM of_options WHERE key = 'OpenRestyKeepaliveTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_keepalive_requests', value, 'business', 0, 'Keepalive 请求数'
+FROM of_options WHERE key = 'OpenRestyKeepaliveRequests'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_client_header_timeout', value, 'business', 0, '客户端头超时（秒）'
+FROM of_options WHERE key = 'OpenRestyClientHeaderTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_client_body_timeout', value, 'business', 0, '客户端体超时（秒）'
+FROM of_options WHERE key = 'OpenRestyClientBodyTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_client_max_body_size', value, 'business', 0, '客户端最大体大小'
+FROM of_options WHERE key = 'OpenRestyClientMaxBodySize'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_large_client_header_buffers', value, 'business', 0, '大客户端头缓冲区'
+FROM of_options WHERE key = 'OpenRestyLargeClientHeaderBuffers'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_send_timeout', value, 'business', 0, '发送超时（秒）'
+FROM of_options WHERE key = 'OpenRestySendTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_resolvers', COALESCE(value, ''), 'business', 0, 'DNS 解析器'
+FROM of_options WHERE key = 'OpenRestyResolvers'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_connect_timeout', value, 'business', 0, '代理连接超时（秒）'
+FROM of_options WHERE key = 'OpenRestyProxyConnectTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_send_timeout', value, 'business', 0, '代理发送超时（秒）'
+FROM of_options WHERE key = 'OpenRestyProxySendTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_read_timeout', value, 'business', 0, '代理读取超时（秒）'
+FROM of_options WHERE key = 'OpenRestyProxyReadTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_websocket_enabled', value, 'business', 0, 'WebSocket 支持开关'
+FROM of_options WHERE key = 'OpenRestyWebsocketEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_http3_enabled', value, 'business', 0, 'HTTP/3 支持开关'
+FROM of_options WHERE key = 'OpenRestyHTTP3Enabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_request_buffering_enabled', value, 'business', 0, '代理请求缓冲开关'
+FROM of_options WHERE key = 'OpenRestyProxyRequestBufferingEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_buffering_enabled', value, 'business', 0, '代理响应缓冲开关'
+FROM of_options WHERE key = 'OpenRestyProxyBufferingEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_buffers', value, 'business', 0, '代理缓冲区'
+FROM of_options WHERE key = 'OpenRestyProxyBuffers'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_buffer_size', value, 'business', 0, '代理缓冲区大小'
+FROM of_options WHERE key = 'OpenRestyProxyBufferSize'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_proxy_busy_buffers_size', value, 'business', 0, '代理繁忙缓冲区大小'
+FROM of_options WHERE key = 'OpenRestyProxyBusyBuffersSize'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_gzip_enabled', value, 'business', 0, 'Gzip 压缩开关'
+FROM of_options WHERE key = 'OpenRestyGzipEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_gzip_min_length', value, 'business', 0, 'Gzip 最小长度'
+FROM of_options WHERE key = 'OpenRestyGzipMinLength'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_gzip_comp_level', value, 'business', 0, 'Gzip 压缩级别'
+FROM of_options WHERE key = 'OpenRestyGzipCompLevel'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_enabled', value, 'business', 0, '缓存开关'
+FROM of_options WHERE key = 'OpenRestyCacheEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_path', COALESCE(value, ''), 'business', 0, '缓存路径'
+FROM of_options WHERE key = 'OpenRestyCachePath'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_levels', value, 'business', 0, '缓存层级'
+FROM of_options WHERE key = 'OpenRestyCacheLevels'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_inactive', value, 'business', 0, '缓存不活跃时间'
+FROM of_options WHERE key = 'OpenRestyCacheInactive'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_max_size', value, 'business', 0, '缓存最大大小'
+FROM of_options WHERE key = 'OpenRestyCacheMaxSize'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_key_template', value, 'business', 0, '缓存键模板'
+FROM of_options WHERE key = 'OpenRestyCacheKeyTemplate'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_lock_enabled', value, 'business', 0, '缓存锁开关'
+FROM of_options WHERE key = 'OpenRestyCacheLockEnabled'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_lock_timeout', value, 'business', 0, '缓存锁超时'
+FROM of_options WHERE key = 'OpenRestyCacheLockTimeout'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_cache_use_stale', value, 'business', 0, '缓存失效策略'
+FROM of_options WHERE key = 'OpenRestyCacheUseStale'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO w_system_configs (key, value, type, visibility, description)
+SELECT 'openresty_main_config_template', value, 'business', 0, '主配置模板'
+FROM of_options WHERE key = 'OpenRestyMainConfigTemplate'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+-- +goose Down
+-- 回滚时删除所有迁移的配置项
+DELETE FROM w_system_configs WHERE key IN (
+    'agent_discovery_token',
+    'agent_heartbeat_interval',
+    'agent_websocket_upgrade_enabled',
+    'node_offline_threshold',
+    'agent_update_repo',
+    'geoip_provider',
+    'database_auto_cleanup_enabled',
+    'database_auto_cleanup_retention_days',
+    'uptime_kuma_enabled',
+    'uptime_kuma_url',
+    'uptime_kuma_username',
+    'uptime_kuma_password',
+    'uptime_kuma_monitor_scope',
+    'uptime_kuma_selected_sites',
+    'uptime_kuma_sync_interval',
+    'uptime_kuma_interval',
+    'uptime_kuma_retry',
+    'uptime_kuma_retry_interval',
+    'uptime_kuma_timeout',
+    'openresty_default_server_return_status',
+    'openresty_worker_processes',
+    'openresty_worker_connections',
+    'openresty_worker_rlimit_nofile',
+    'openresty_events_use',
+    'openresty_events_multi_accept_enabled',
+    'openresty_keepalive_timeout',
+    'openresty_keepalive_requests',
+    'openresty_client_header_timeout',
+    'openresty_client_body_timeout',
+    'openresty_client_max_body_size',
+    'openresty_large_client_header_buffers',
+    'openresty_send_timeout',
+    'openresty_resolvers',
+    'openresty_proxy_connect_timeout',
+    'openresty_proxy_send_timeout',
+    'openresty_proxy_read_timeout',
+    'openresty_websocket_enabled',
+    'openresty_http3_enabled',
+    'openresty_proxy_request_buffering_enabled',
+    'openresty_proxy_buffering_enabled',
+    'openresty_proxy_buffers',
+    'openresty_proxy_buffer_size',
+    'openresty_proxy_busy_buffers_size',
+    'openresty_gzip_enabled',
+    'openresty_gzip_min_length',
+    'openresty_gzip_comp_level',
+    'openresty_cache_enabled',
+    'openresty_cache_path',
+    'openresty_cache_levels',
+    'openresty_cache_inactive',
+    'openresty_cache_max_size',
+    'openresty_cache_key_template',
+    'openresty_cache_lock_enabled',
+    'openresty_cache_lock_timeout',
+    'openresty_cache_use_stale',
+    'openresty_main_config_template'
+);

internal/infra/persistence/migrator/goose/postgres/202606220005_drop_of_options.sql

@@ -0,0 +1,10 @@
+-- +goose Up
+-- of_options 配置已于 202606220004 迁移至 w_system_configs，删除遗留表。
+DROP TABLE IF EXISTS of_options;
+
+-- +goose Down
+-- 回滚时重建空表结构（数据无法恢复，迁移来源已为 w_system_configs）。
+CREATE TABLE IF NOT EXISTS of_options (
+    key VARCHAR(128) PRIMARY KEY,
+    value TEXT NOT NULL DEFAULT ''
+);

internal/infra/persistence/migrator/goose/postgres/202606270001_make_version_primary_key.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+-- Remove old PRIMARY KEY on id, set version as PRIMARY KEY, drop id column
+
+-- 1. 移除旧主键约束
+ALTER TABLE of_config_versions DROP CONSTRAINT IF EXISTS of_config_versions_pkey;
+
+-- 2. 移除原先在 version 字段的唯一索引（因为 version 变成主键，主键隐含唯一性）
+DROP INDEX IF EXISTS idx_of_config_versions_version;
+
+-- 3. 将 version 设为新主键
+ALTER TABLE of_config_versions ADD PRIMARY KEY (version);
+
+-- 4. 彻底删除 id 列
+ALTER TABLE of_config_versions DROP COLUMN IF EXISTS id;
+
+-- +goose Down
+ALTER TABLE of_config_versions DROP CONSTRAINT IF EXISTS of_config_versions_pkey;
+ALTER TABLE of_config_versions ADD COLUMN IF NOT EXISTS id BIGSERIAL PRIMARY KEY;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_config_versions_version ON of_config_versions (version);

internal/infra/persistence/migrator/goose/postgres/202606300001_sync_all_legacy_sequences.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+SELECT setval(pg_get_serial_sequence('w_users', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM w_users), 0), 1), COALESCE((SELECT MAX(id) FROM w_users), 0) > 0);
+SELECT setval(pg_get_serial_sequence('w_auth_sources', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM w_auth_sources), 0), 1), COALESCE((SELECT MAX(id) FROM w_auth_sources), 0) > 0);
+SELECT setval(pg_get_serial_sequence('w_external_accounts', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM w_external_accounts), 0), 1), COALESCE((SELECT MAX(id) FROM w_external_accounts), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_origins', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_origins), 0), 1), COALESCE((SELECT MAX(id) FROM of_origins), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_apply_logs', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_apply_logs), 0), 1), COALESCE((SELECT MAX(id) FROM of_apply_logs), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_proxy_routes', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_proxy_routes), 0), 1), COALESCE((SELECT MAX(id) FROM of_proxy_routes), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_nodes', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_nodes), 0), 1), COALESCE((SELECT MAX(id) FROM of_nodes), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_waf_rule_groups', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_rule_groups), 0), 1), COALESCE((SELECT MAX(id) FROM of_waf_rule_groups), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_waf_ip_groups', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_waf_ip_groups), 0), 1), COALESCE((SELECT MAX(id) FROM of_waf_ip_groups), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_tls_certificates', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_tls_certificates), 0), 1), COALESCE((SELECT MAX(id) FROM of_tls_certificates), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_managed_domains', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_managed_domains), 0), 1), COALESCE((SELECT MAX(id) FROM of_managed_domains), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_dns_accounts', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_dns_accounts), 0), 1), COALESCE((SELECT MAX(id) FROM of_dns_accounts), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_acme_accounts', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_acme_accounts), 0), 1), COALESCE((SELECT MAX(id) FROM of_acme_accounts), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_pages_projects', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_pages_projects), 0), 1), COALESCE((SELECT MAX(id) FROM of_pages_projects), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_pages_deployments', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_pages_deployments), 0), 1), COALESCE((SELECT MAX(id) FROM of_pages_deployments), 0) > 0);
+SELECT setval(pg_get_serial_sequence('of_pages_deployment_files', 'id'), GREATEST(COALESCE((SELECT MAX(id) FROM of_pages_deployment_files), 0), 1), COALESCE((SELECT MAX(id) FROM of_pages_deployment_files), 0) > 0);
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/postgres/202607120001_create_zone_domain_tables.sql

@@ -0,0 +1,28 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS of_zones (
+    id BIGSERIAL PRIMARY KEY,
+    domain VARCHAR(255) NOT NULL,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_zones_domain ON of_zones (domain);
+
+CREATE TABLE IF NOT EXISTS of_zone_domains (
+    id BIGSERIAL PRIMARY KEY,
+    zone_id BIGINT NOT NULL,
+    proxy_route_id BIGINT,
+    domain VARCHAR(255) NOT NULL,
+    cert_id BIGINT,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_zone_domains_domain ON of_zone_domains (domain);
+CREATE INDEX IF NOT EXISTS idx_of_zone_domains_zone_id ON of_zone_domains (zone_id);
+CREATE INDEX IF NOT EXISTS idx_of_zone_domains_proxy_route_id ON of_zone_domains (proxy_route_id);
+CREATE INDEX IF NOT EXISTS idx_of_zone_domains_cert_id ON of_zone_domains (cert_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS of_zone_domains;
+DROP TABLE IF EXISTS of_zones;

internal/infra/persistence/migrator/goose/postgres/202607120002_import_zone_domains.sql

@@ -0,0 +1,8 @@
+-- +goose Up
+-- Marker: Zone 域名从旧路由列 / of_managed_domains 的导入由 migrator.Migrate()
+-- 在全部 goose SQL 应用后自动执行（publicsuffix 根域解析无法用纯 SQL 正确完成）。
+-- 本文件仅占位版本号，保证升级链路有序：建表 → 导入 → 删旧列。
+SELECT 1;
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/postgres/202607130001_drop_legacy_route_domain_columns.sql

@@ -0,0 +1,35 @@
+-- +goose Up
+-- 第二阶段：删除反代路由冗余域名/证书列与托管域名表。
+-- 执行前必须完成 migrate-zones 且配置预览验收通过。
+
+DROP INDEX IF EXISTS idx_of_proxy_routes_domain;
+
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS domain;
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS domains;
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS cert_id;
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS cert_ids;
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS domain_cert_ids;
+
+DROP TABLE IF EXISTS of_managed_domains;
+
+-- +goose Down
+-- 仅恢复开发库结构，不回填历史域名/证书数据。
+
+CREATE TABLE IF NOT EXISTS of_managed_domains (
+    id BIGSERIAL PRIMARY KEY,
+    domain VARCHAR(255) NOT NULL,
+    cert_id BIGINT,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    remark VARCHAR(255) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_managed_domains_domain ON of_managed_domains (domain);
+
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS domain VARCHAR(255) NOT NULL DEFAULT '';
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS domains TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS cert_id BIGINT;
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS cert_ids TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS domain_cert_ids TEXT NOT NULL DEFAULT '[]';
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_proxy_routes_domain ON of_proxy_routes (domain);

internal/infra/persistence/migrator/goose/postgres/202607140001_drop_unused_remark_columns.sql

@@ -0,0 +1,16 @@
+-- +goose Up
+-- 移除业务实体上未再使用的备注列（证书与源站备注保留）。
+
+ALTER TABLE of_zones DROP COLUMN IF EXISTS remark;
+ALTER TABLE of_zone_domains DROP COLUMN IF EXISTS remark;
+ALTER TABLE of_proxy_routes DROP COLUMN IF EXISTS remark;
+ALTER TABLE of_waf_rule_groups DROP COLUMN IF EXISTS remark;
+ALTER TABLE of_waf_ip_groups DROP COLUMN IF EXISTS remark;
+
+-- +goose Down
+
+ALTER TABLE of_zones ADD COLUMN IF NOT EXISTS remark VARCHAR(255) NOT NULL DEFAULT '';
+ALTER TABLE of_zone_domains ADD COLUMN IF NOT EXISTS remark VARCHAR(255) NOT NULL DEFAULT '';
+ALTER TABLE of_proxy_routes ADD COLUMN IF NOT EXISTS remark VARCHAR(255) NOT NULL DEFAULT '';
+ALTER TABLE of_waf_rule_groups ADD COLUMN IF NOT EXISTS remark VARCHAR(255) NOT NULL DEFAULT '';
+ALTER TABLE of_waf_ip_groups ADD COLUMN IF NOT EXISTS remark VARCHAR(255) NOT NULL DEFAULT '';

internal/infra/persistence/migrator/goose/postgres/202607150001_orchestrate_waf_rules.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+ALTER TABLE of_waf_rule_groups
+    ADD COLUMN graph TEXT NOT NULL DEFAULT '',
+    ADD COLUMN revision BIGINT NOT NULL DEFAULT 1;
+
+ALTER TABLE of_waf_rule_group_bindings
+    ADD COLUMN sequence INTEGER NOT NULL DEFAULT 0;
+
+-- +goose Down
+ALTER TABLE of_waf_rule_group_bindings DROP COLUMN sequence;
+ALTER TABLE of_waf_rule_groups DROP COLUMN revision, DROP COLUMN graph;

internal/infra/persistence/migrator/goose/postgres/202607150002_reset_waf_rule_graphs.sql

@@ -0,0 +1,17 @@
+-- +goose Up
+UPDATE of_waf_rule_groups
+SET graph = '{"schema_version":1,"nodes":[{"id":"start","type":"start","position":{"x":0,"y":0},"config":{}},{"id":"allow","type":"allow","position":{"x":320,"y":0},"config":{}}],"edges":[{"id":"start-allow","source":"start","source_handle":"next","target":"allow"}]}',
+    revision = 1;
+
+WITH ordered AS (
+    SELECT id, ROW_NUMBER() OVER (PARTITION BY proxy_route_id ORDER BY id) - 1 AS new_sequence
+    FROM of_waf_rule_group_bindings
+)
+UPDATE of_waf_rule_group_bindings AS binding
+SET sequence = ordered.new_sequence
+FROM ordered
+WHERE binding.id = ordered.id;
+
+-- +goose Down
+UPDATE of_waf_rule_group_bindings SET sequence = 0;
+UPDATE of_waf_rule_groups SET revision = 1;

internal/infra/persistence/migrator/goose/postgres/202607150003_drop_legacy_waf_rule_fields.sql

@@ -0,0 +1,27 @@
+-- +goose Up
+ALTER TABLE of_waf_rule_groups DROP COLUMN block_status_code;
+ALTER TABLE of_waf_rule_groups DROP COLUMN block_response_body;
+ALTER TABLE of_waf_rule_groups DROP COLUMN ip_whitelist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN ip_blacklist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN ip_whitelist_groups;
+ALTER TABLE of_waf_rule_groups DROP COLUMN ip_blacklist_groups;
+ALTER TABLE of_waf_rule_groups DROP COLUMN country_whitelist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN country_blacklist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN region_whitelist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN region_blacklist;
+ALTER TABLE of_waf_rule_groups DROP COLUMN pow_enabled;
+ALTER TABLE of_waf_rule_groups DROP COLUMN pow_config;
+
+-- +goose Down
+ALTER TABLE of_waf_rule_groups ADD COLUMN block_status_code INTEGER NOT NULL DEFAULT 418;
+ALTER TABLE of_waf_rule_groups ADD COLUMN block_response_body TEXT NOT NULL DEFAULT '';
+ALTER TABLE of_waf_rule_groups ADD COLUMN ip_whitelist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN ip_blacklist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN ip_whitelist_groups TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN ip_blacklist_groups TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN country_whitelist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN country_blacklist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN region_whitelist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN region_blacklist TEXT NOT NULL DEFAULT '[]';
+ALTER TABLE of_waf_rule_groups ADD COLUMN pow_enabled BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE of_waf_rule_groups ADD COLUMN pow_config TEXT NOT NULL DEFAULT '{}';

internal/infra/persistence/migrator/goose/postgres/202607170001_add_pages_system_configs.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES
+  ('pages_max_package_size_mb', '100', 'business', 0, 'Pages 部署包上传大小上限（MiB）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('pages_max_history_count', '20', 'business', 0, 'Pages 每个项目最大历史部署保留数（0 表示不限制）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key IN ('pages_max_package_size_mb', 'pages_max_history_count');

internal/infra/persistence/migrator/goose/postgres/202607180001_update_agent_heartbeat_offline_defaults.sql

@@ -0,0 +1,27 @@
+-- +goose Up
+-- 将仍为历史默认值的心跳/离线配置升级为新默认：心跳 3s、离线 60s。
+-- 已由管理员改成其他值的配置不受影响。
+UPDATE w_system_configs
+SET value = '3000',
+    updated_at = CURRENT_TIMESTAMP
+WHERE key = 'agent_heartbeat_interval'
+  AND value = '10000';
+
+UPDATE w_system_configs
+SET value = '60000',
+    updated_at = CURRENT_TIMESTAMP
+WHERE key = 'node_offline_threshold'
+  AND value = '120000';
+
+-- +goose Down
+UPDATE w_system_configs
+SET value = '10000',
+    updated_at = CURRENT_TIMESTAMP
+WHERE key = 'agent_heartbeat_interval'
+  AND value = '3000';
+
+UPDATE w_system_configs
+SET value = '120000',
+    updated_at = CURRENT_TIMESTAMP
+WHERE key = 'node_offline_threshold'
+  AND value = '60000';

internal/infra/persistence/migrator/goose/postgres/202607190001_add_openresty_default_rate_limits.sql

@@ -0,0 +1,14 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES
+  ('openresty_default_limit_conn_per_server', '0', 'business', 0, '默认站点并发连接上限（0 关闭）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('openresty_default_limit_conn_per_ip', '0', 'business', 0, '默认单 IP 并发连接上限（0 关闭）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('openresty_default_limit_rate', '', 'business', 0, '默认单请求带宽限速（空关闭）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key IN (
+  'openresty_default_limit_conn_per_server',
+  'openresty_default_limit_conn_per_ip',
+  'openresty_default_limit_rate'
+);

internal/infra/persistence/migrator/goose/postgres/202607190002_add_pages_source_runtime.sql

@@ -0,0 +1,82 @@
+-- +goose Up
+ALTER TABLE of_pages_projects
+    ADD COLUMN IF NOT EXISTS content_config_version INTEGER NOT NULL DEFAULT 0;
+
+ALTER TABLE of_pages_deployments
+    ADD COLUMN IF NOT EXISTS source_type VARCHAR(32) NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS source_identity CHAR(64),
+    ADD COLUMN IF NOT EXISTS source_revision CHAR(64),
+    ADD COLUMN IF NOT EXISTS source_label VARCHAR(255) NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS source_meta TEXT NOT NULL DEFAULT '',
+    ADD COLUMN IF NOT EXISTS trigger_type VARCHAR(32) NOT NULL DEFAULT '';
+
+UPDATE of_pages_deployments
+SET source_type = 'manual_upload',
+    trigger_type = 'manual_upload';
+
+CREATE TABLE IF NOT EXISTS of_pages_project_sources (
+    id BIGSERIAL PRIMARY KEY,
+    project_id BIGINT NOT NULL,
+    source_type VARCHAR(32) NOT NULL DEFAULT '',
+    remote_url TEXT NOT NULL DEFAULT '',
+    allow_insecure BOOLEAN NOT NULL DEFAULT FALSE,
+    github_repository VARCHAR(255) NOT NULL DEFAULT '',
+    release_selector VARCHAR(16) NOT NULL DEFAULT '',
+    release_tag VARCHAR(255) NOT NULL DEFAULT '',
+    asset_name VARCHAR(255) NOT NULL DEFAULT '',
+    auto_update_enabled BOOLEAN NOT NULL DEFAULT FALSE,
+    check_interval_minutes INTEGER NOT NULL DEFAULT 0,
+    config_version INTEGER NOT NULL DEFAULT 0,
+    source_identity CHAR(64) NOT NULL DEFAULT '',
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_pages_project_sources_project_id
+    ON of_pages_project_sources (project_id);
+
+CREATE TABLE IF NOT EXISTS of_pages_project_source_runtime (
+    source_id BIGINT PRIMARY KEY,
+    etag VARCHAR(512) NOT NULL DEFAULT '',
+    last_seen_revision CHAR(64) NOT NULL DEFAULT '',
+    last_seen_detail TEXT NOT NULL DEFAULT '',
+    last_applied_revision CHAR(64) NOT NULL DEFAULT '',
+    last_applied_detail TEXT NOT NULL DEFAULT '',
+    sync_status VARCHAR(32) NOT NULL DEFAULT '',
+    last_error TEXT NOT NULL DEFAULT '',
+    last_checked_at TIMESTAMPTZ,
+    last_synced_at TIMESTAMPTZ,
+    next_check_at TIMESTAMPTZ,
+    lease_expires_at TIMESTAMPTZ,
+    lease_token VARCHAR(64) NOT NULL DEFAULT '',
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_of_pages_project_source_runtime_next_check_at
+    ON of_pages_project_source_runtime (next_check_at);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_pages_deployments_project_number
+    ON of_pages_deployments (project_id, deployment_number);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_of_pages_deployments_source_revision
+    ON of_pages_deployments (project_id, source_identity, source_revision)
+    WHERE source_identity IS NOT NULL AND source_revision IS NOT NULL;
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_of_pages_deployments_source_revision;
+DROP INDEX IF EXISTS idx_of_pages_deployments_project_number;
+DROP INDEX IF EXISTS idx_of_pages_project_source_runtime_next_check_at;
+DROP TABLE IF EXISTS of_pages_project_source_runtime;
+DROP INDEX IF EXISTS idx_of_pages_project_sources_project_id;
+DROP TABLE IF EXISTS of_pages_project_sources;
+
+ALTER TABLE of_pages_deployments
+    DROP COLUMN IF EXISTS trigger_type,
+    DROP COLUMN IF EXISTS source_meta,
+    DROP COLUMN IF EXISTS source_label,
+    DROP COLUMN IF EXISTS source_revision,
+    DROP COLUMN IF EXISTS source_identity,
+    DROP COLUMN IF EXISTS source_type;
+
+ALTER TABLE of_pages_projects
+    DROP COLUMN IF EXISTS content_config_version;

internal/infra/persistence/migrator/goose/postgres/202607190003_seed_pages_source_scan.sql

@@ -0,0 +1,38 @@
+-- +goose Up
+-- Earlier built-in schedules used explicit IDs, so advance the identity only
+-- when it trails either existing rows or an already-higher sequence value.
+SELECT setval(
+    pg_get_serial_sequence('w_schedules', 'id'),
+    GREATEST(
+        1,
+        COALESCE((SELECT MAX(id) FROM w_schedules), 0),
+        COALESCE((
+            SELECT sequences.last_value
+            FROM pg_sequences AS sequences
+            WHERE format('%I.%I', sequences.schemaname, sequences.sequencename)::regclass =
+                  pg_get_serial_sequence('w_schedules', 'id')::regclass
+        ), 0)
+    ),
+    TRUE
+);
+
+INSERT INTO w_schedules (name, task_type, cron, payload, is_active, created_at, updated_at)
+SELECT
+    'OpenFlare Pages 部署源扫描',
+    'of_pages_source_scan',
+    '0 0 * * *',
+    '{}',
+    TRUE,
+    CURRENT_TIMESTAMP,
+    CURRENT_TIMESTAMP
+WHERE NOT EXISTS (
+    SELECT 1 FROM w_schedules WHERE task_type = 'of_pages_source_scan'
+);
+
+-- +goose Down
+DELETE FROM w_schedules
+WHERE task_type = 'of_pages_source_scan'
+  AND name = 'OpenFlare Pages 部署源扫描'
+  AND cron = '0 0 * * *'
+  AND payload = '{}'
+  AND is_active = TRUE;

internal/infra/persistence/migrator/goose/postgres/202607200001_add_openresty_default_limit_req_per_ip.sql

@@ -0,0 +1,12 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES
+  ('openresty_default_limit_req_per_ip', '', 'business', 0, '默认单 IP 请求频率限制（空关闭，例如 10r/s、100r/m）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+ALTER TABLE of_proxy_routes ADD COLUMN limit_req_per_ip VARCHAR(32) NOT NULL DEFAULT '';
+
+-- +goose Down
+ALTER TABLE of_proxy_routes DROP COLUMN limit_req_per_ip;
+
+DELETE FROM w_system_configs WHERE key = 'openresty_default_limit_req_per_ip';

internal/infra/persistence/migrator/goose/sqlite/202606050001_bridge_legacy.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+-- Historical Wavelet→OpenFlare table rename bridge (formerly Go migration).
+-- Fresh installs and current of_* schemas need no action.
+SELECT 1;
+
+-- +goose Down
+SELECT 1;

internal/infra/persistence/migrator/goose/sqlite/202606090001_initial_schema.sql

@@ -0,0 +1,184 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS users (
+    id BIGINT PRIMARY KEY,
+    username VARCHAR(64) UNIQUE,
+    password VARCHAR(255),
+    nickname VARCHAR(255),
+    email VARCHAR(255),
+    avatar_url VARCHAR(255),
+    is_active BOOLEAN DEFAULT TRUE,
+    is_admin BOOLEAN DEFAULT FALSE,
+    bio VARCHAR(500),
+    phone VARCHAR(32),
+    gender VARCHAR(16),
+    website VARCHAR(255),
+    location VARCHAR(255),
+    last_login_at DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
+CREATE INDEX IF NOT EXISTS idx_users_is_active ON users (is_active);
+CREATE INDEX IF NOT EXISTS idx_users_last_login_at ON users (last_login_at);
+CREATE INDEX IF NOT EXISTS idx_users_created_at ON users (created_at);
+
+CREATE TABLE IF NOT EXISTS auth_sources (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name VARCHAR(80) NOT NULL UNIQUE,
+    type VARCHAR(20) NOT NULL,
+    display_name VARCHAR(100),
+    is_active BOOLEAN NOT NULL DEFAULT FALSE,
+    client_id VARCHAR(255),
+    client_secret VARCHAR(1024),
+    openid_discovery_url VARCHAR(1024),
+    scopes VARCHAR(255),
+    icon_url VARCHAR(1024),
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_auth_sources_is_active ON auth_sources (is_active);
+
+CREATE TABLE IF NOT EXISTS external_accounts (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    auth_source_id BIGINT,
+    user_id BIGINT NOT NULL,
+    external_id VARCHAR(255) NOT NULL,
+    external_username VARCHAR(255),
+    email VARCHAR(255),
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_external_accounts_auth_source_id ON external_accounts (auth_source_id);
+CREATE INDEX IF NOT EXISTS idx_external_accounts_user_id ON external_accounts (user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_external_accounts_source_external ON external_accounts (auth_source_id, external_id);
+
+CREATE TABLE IF NOT EXISTS system_configs (
+    key VARCHAR(64) PRIMARY KEY,
+    value TEXT NOT NULL,
+    type VARCHAR(32) NOT NULL DEFAULT 'system',
+    visibility INTEGER NOT NULL DEFAULT 0,
+    description VARCHAR(255),
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS uploads (
+    id BIGINT PRIMARY KEY,
+    user_id BIGINT NOT NULL,
+    file_name VARCHAR(255) NOT NULL,
+    file_path VARCHAR(500) NOT NULL,
+    file_size BIGINT NOT NULL,
+    mime_type VARCHAR(100) NOT NULL,
+    extension VARCHAR(50) NOT NULL,
+    hash VARCHAR(64),
+    storage_driver VARCHAR(50) NOT NULL,
+    type VARCHAR(50) NOT NULL,
+    status VARCHAR(20) NOT NULL,
+    metadata JSON,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads (user_id);
+CREATE INDEX IF NOT EXISTS idx_uploads_file_path ON uploads (file_path);
+CREATE INDEX IF NOT EXISTS idx_uploads_hash ON uploads (hash);
+CREATE INDEX IF NOT EXISTS idx_uploads_type ON uploads (type);
+
+CREATE TABLE IF NOT EXISTS access_tokens (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id BIGINT NOT NULL,
+    name VARCHAR(128) NOT NULL,
+    token_hash VARCHAR(64) NOT NULL UNIQUE,
+    masked_token VARCHAR(64) NOT NULL,
+    last_used_at DATETIME,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_access_tokens_user_id ON access_tokens (user_id);
+
+CREATE TABLE IF NOT EXISTS task_executions (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(128) NOT NULL UNIQUE,
+    task_type VARCHAR(64) NOT NULL,
+    task_name VARCHAR(128),
+    status VARCHAR(32) NOT NULL,
+    retryable BOOLEAN NOT NULL DEFAULT FALSE,
+    max_retry INTEGER NOT NULL DEFAULT 0,
+    retry_count INTEGER NOT NULL DEFAULT 0,
+    log TEXT,
+    error_message TEXT,
+    result TEXT,
+    started_at DATETIME,
+    finished_at DATETIME,
+    duration BIGINT,
+    payload TEXT,
+    triggered_by VARCHAR(32) NOT NULL DEFAULT 'system',
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_task_executions_task_type ON task_executions (task_type);
+CREATE INDEX IF NOT EXISTS idx_task_executions_status ON task_executions (status);
+CREATE INDEX IF NOT EXISTS idx_task_executions_started_at ON task_executions (started_at);
+CREATE INDEX IF NOT EXISTS idx_task_executions_created_at ON task_executions (created_at);
+
+CREATE TABLE IF NOT EXISTS templates (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    key VARCHAR(80) NOT NULL UNIQUE,
+    name VARCHAR(100) NOT NULL,
+    type VARCHAR(20) NOT NULL DEFAULT 'email',
+    subject VARCHAR(255),
+    content TEXT NOT NULL,
+    description VARCHAR(255),
+    is_system BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_templates_is_system ON templates (is_system);
+CREATE INDEX IF NOT EXISTS idx_templates_created_at ON templates (created_at);
+CREATE INDEX IF NOT EXISTS idx_templates_updated_at ON templates (updated_at);
+
+INSERT INTO system_configs (key, value, type, visibility, description, created_at, updated_at) VALUES
+    ('cap_login_enabled', 'false', 'system', 1, '是否启用登录人机验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_auto_solve', 'true', 'system', 1, '打开页面后是否自动开始计算，关闭则需用户手动点击触发', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_count', '1', 'system', 0, '客户端需求解的 PoW 难题总数，默认 1，推荐 1～5', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_size', '32', 'system', 0, '人机验证盐值长度', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_difficulty', '4', 'system', 0, '人机验证 PoW 难度（目标前缀长度）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_challenge_ttl_seconds', '600', 'system', 0, '人机验证难题有效时间（秒）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('cap_token_ttl_seconds', '1200', 'system', 0, '人机验证兑换凭证有效时间（秒）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('server_address', '', 'system', 0, '服务器地址（用于跨域源控制，不设定则允许任意源）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_host', '', 'system', 0, 'SMTP 服务器地址（例如 smtp.example.com）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_port', '587', 'system', 0, 'SMTP 端口（例如 587 或 465）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_username', '', 'system', 0, 'SMTP 账户（如 sender@example.com）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('smtp_password', '', 'system', 0, 'SMTP 访问凭证（授权码/密码）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('upload_allowed_extensions', 'jpg,png,webp', 'system', 1, '允许上传的图片扩展名（逗号分隔）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('site_name', 'OpenFlare', 'system', 1, '系统平台的展示名称', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('password_login_enabled', 'true', 'system', 1, '是否允许使用账号密码登录', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('registration_enabled', 'false', 'system', 1, '控制普通用户是否可以自主注册（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('password_register_enabled', 'false', 'system', 1, '是否允许通过密码创建本地账号', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('oidc_login_enabled', 'true', 'system', 1, '是否允许使用第三方 OIDC 认证源登录', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('max_api_keys_per_user', '5', 'business', 1, '限制每个普通用户可以创建的 API Key 最大数量', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('email_login_verification_enabled', 'false', 'system', 1, '是否开启邮箱登录验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('email_register_verification_enabled', 'false', 'system', 1, '是否开启邮箱注册验证（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('menu_display_config', '{}', 'system', 1, '目录显示配置（JSON 字符串，格式为 {url: enabled}）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('search_engine_indexing_enabled', 'false', 'system', 1, '是否允许搜索引擎爬取/检索该站点（true/false）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('update_upstream_repository', 'Rain-kl/OpenFlare', 'system', 0, 'GitHub Actions Release 上游仓库（owner/repo 或 GitHub 仓库地址）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('storage_config', '{"driver":"local","local":{"root":"."},"s3":{"region":"us-east-1"},"r2":{"region":"auto"},"minio":{"region":"us-east-1","path_style":true},"oss":{},"webdav":{}}', 'system', 0, '文件存储驱动及连接配置（JSON）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO users (id, username, password, nickname, avatar_url, is_active, is_admin, last_login_at, created_at, updated_at)
+VALUES (1, 'admin', '12345678', 'Administrator', '', TRUE, TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (username) DO NOTHING;
+
+INSERT INTO templates (key, name, type, subject, content, description, is_system, created_at, updated_at) VALUES
+    ('login_email', '登录验证码邮件', 'email', 'OpenFlare 登录验证码', '<h3>OpenFlare 登录验证</h3><p>您的登录验证码为：<strong>{{.Code}}</strong>，5分钟内有效，请勿将验证码泄露给他人。</p>', '用户密码登录时发送的验证码邮件模板，支持变量：{{.Code}}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+    ('register_email', '注册验证码邮件', 'email', 'OpenFlare 注册验证码', '<h3>OpenFlare 注册验证</h3><p>您的注册验证码为：<strong>{{.Code}}</strong>，5分钟内有效，请勿泄露给他人。</p>', '用户注册时发送的验证码邮件模板，支持变量：{{.Code}}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS templates;
+DROP TABLE IF EXISTS task_executions;
+DROP TABLE IF EXISTS access_tokens;
+DROP TABLE IF EXISTS uploads;
+DROP TABLE IF EXISTS system_configs;
+DROP TABLE IF EXISTS external_accounts;
+DROP TABLE IF EXISTS auth_sources;
+DROP TABLE IF EXISTS users;

internal/infra/persistence/migrator/goose/sqlite/202606100001_create_schedules.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS schedules (
+    id BIGINT PRIMARY KEY,
+    name VARCHAR(128) NOT NULL,
+    task_type VARCHAR(64) NOT NULL,
+    cron VARCHAR(64) NOT NULL,
+    payload TEXT,
+    is_active BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_schedules_is_active ON schedules (is_active);
+
+-- Seed initial cleanup task
+INSERT INTO schedules (id, name, task_type, cron, payload, is_active, created_at, updated_at)
+VALUES (1, '清理未使用上传', 'cleanup_unused_uploads', '0 */2 * * *', '{}', TRUE, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (id) DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS schedules;

internal/infra/persistence/migrator/goose/sqlite/202606100002_access_token_is_admin.sql

@@ -0,0 +1,5 @@
+-- +goose Up
+ALTER TABLE access_tokens ADD COLUMN is_admin BOOLEAN NOT NULL DEFAULT 0;
+
+-- +goose Down
+ALTER TABLE access_tokens DROP COLUMN is_admin;

internal/infra/persistence/migrator/goose/sqlite/202606110001_remove_access_token_last_used_at.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+-- +goose StatementBegin
+ALTER TABLE access_tokens DROP COLUMN last_used_at;
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE access_tokens ADD COLUMN last_used_at DATETIME;
+-- +goose StatementEnd

internal/infra/persistence/migrator/goose/sqlite/202606110002_alter_schedules_id_auto_increment.sql

@@ -0,0 +1,32 @@
+-- +goose Up
+-- +goose StatementBegin
+-- 1. Rename existing schedules table
+ALTER TABLE schedules RENAME TO schedules_old;
+
+-- 2. Create new schedules table with AUTOINCREMENT
+CREATE TABLE schedules (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name VARCHAR(128) NOT NULL,
+    task_type VARCHAR(64) NOT NULL,
+    cron VARCHAR(64) NOT NULL,
+    payload TEXT,
+    is_active BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+-- 3. Copy existing data
+INSERT INTO schedules (id, name, task_type, cron, payload, is_active, created_at, updated_at)
+SELECT id, name, task_type, cron, payload, is_active, created_at, updated_at FROM schedules_old;
+
+-- 4. Drop the old table
+DROP TABLE schedules_old;
+
+-- 5. Recreate index
+CREATE INDEX IF NOT EXISTS idx_schedules_is_active ON schedules (is_active);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+-- Re-creating table with AUTOINCREMENT cannot be undone simply without recreating table again.
+-- +goose StatementEnd

internal/infra/persistence/migrator/goose/sqlite/202606110003_rename_tables_to_w_prefix.sql

@@ -0,0 +1,123 @@
+-- +goose Up
+ALTER TABLE users RENAME TO w_users;
+ALTER TABLE auth_sources RENAME TO w_auth_sources;
+ALTER TABLE external_accounts RENAME TO w_external_accounts;
+ALTER TABLE system_configs RENAME TO w_system_configs;
+ALTER TABLE uploads RENAME TO w_uploads;
+ALTER TABLE access_tokens RENAME TO w_access_tokens;
+ALTER TABLE task_executions RENAME TO w_task_executions;
+ALTER TABLE templates RENAME TO w_templates;
+ALTER TABLE schedules RENAME TO w_schedules;
+
+-- Drop and Recreate SQLite indexes
+DROP INDEX IF EXISTS idx_users_email;
+CREATE INDEX IF NOT EXISTS idx_w_users_email ON w_users (email);
+DROP INDEX IF EXISTS idx_users_is_active;
+CREATE INDEX IF NOT EXISTS idx_w_users_is_active ON w_users (is_active);
+DROP INDEX IF EXISTS idx_users_last_login_at;
+CREATE INDEX IF NOT EXISTS idx_w_users_last_login_at ON w_users (last_login_at);
+DROP INDEX IF EXISTS idx_users_created_at;
+CREATE INDEX IF NOT EXISTS idx_w_users_created_at ON w_users (created_at);
+
+DROP INDEX IF EXISTS idx_auth_sources_is_active;
+CREATE INDEX IF NOT EXISTS idx_w_auth_sources_is_active ON w_auth_sources (is_active);
+
+DROP INDEX IF EXISTS idx_external_accounts_auth_source_id;
+CREATE INDEX IF NOT EXISTS idx_w_external_accounts_auth_source_id ON w_external_accounts (auth_source_id);
+DROP INDEX IF EXISTS idx_external_accounts_user_id;
+CREATE INDEX IF NOT EXISTS idx_w_external_accounts_user_id ON w_external_accounts (user_id);
+DROP INDEX IF EXISTS idx_external_accounts_source_external;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_w_external_accounts_source_external ON w_external_accounts (auth_source_id, external_id);
+
+DROP INDEX IF EXISTS idx_uploads_user_id;
+CREATE INDEX IF NOT EXISTS idx_w_uploads_user_id ON w_uploads (user_id);
+DROP INDEX IF EXISTS idx_uploads_file_path;
+CREATE INDEX IF NOT EXISTS idx_w_uploads_file_path ON w_uploads (file_path);
+DROP INDEX IF EXISTS idx_uploads_hash;
+CREATE INDEX IF NOT EXISTS idx_w_uploads_hash ON w_uploads (hash);
+DROP INDEX IF EXISTS idx_uploads_type;
+CREATE INDEX IF NOT EXISTS idx_w_uploads_type ON w_uploads (type);
+
+DROP INDEX IF EXISTS idx_access_tokens_user_id;
+CREATE INDEX IF NOT EXISTS idx_w_access_tokens_user_id ON w_access_tokens (user_id);
+
+DROP INDEX IF EXISTS idx_task_executions_task_type;
+CREATE INDEX IF NOT EXISTS idx_w_task_executions_task_type ON w_task_executions (task_type);
+DROP INDEX IF EXISTS idx_task_executions_status;
+CREATE INDEX IF NOT EXISTS idx_w_task_executions_status ON w_task_executions (status);
+DROP INDEX IF EXISTS idx_task_executions_started_at;
+CREATE INDEX IF NOT EXISTS idx_w_task_executions_started_at ON w_task_executions (started_at);
+DROP INDEX IF EXISTS idx_task_executions_created_at;
+CREATE INDEX IF NOT EXISTS idx_w_task_executions_created_at ON w_task_executions (created_at);
+
+DROP INDEX IF EXISTS idx_templates_is_system;
+CREATE INDEX IF NOT EXISTS idx_w_templates_is_system ON w_templates (is_system);
+DROP INDEX IF EXISTS idx_templates_created_at;
+CREATE INDEX IF NOT EXISTS idx_w_templates_created_at ON w_templates (created_at);
+DROP INDEX IF EXISTS idx_templates_updated_at;
+CREATE INDEX IF NOT EXISTS idx_w_templates_updated_at ON w_templates (updated_at);
+
+DROP INDEX IF EXISTS idx_schedules_is_active;
+CREATE INDEX IF NOT EXISTS idx_w_schedules_is_active ON w_schedules (is_active);
+
+-- +goose Down
+ALTER TABLE w_schedules RENAME TO schedules;
+ALTER TABLE w_templates RENAME TO templates;
+ALTER TABLE w_task_executions RENAME TO task_executions;
+ALTER TABLE w_access_tokens RENAME TO access_tokens;
+ALTER TABLE w_uploads RENAME TO uploads;
+ALTER TABLE w_system_configs RENAME TO system_configs;
+ALTER TABLE w_external_accounts RENAME TO external_accounts;
+ALTER TABLE w_auth_sources RENAME TO auth_sources;
+ALTER TABLE w_users RENAME TO users;
+
+-- Revert indexes
+DROP INDEX IF EXISTS idx_w_users_email;
+CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
+DROP INDEX IF EXISTS idx_w_users_is_active;
+CREATE INDEX IF NOT EXISTS idx_users_is_active ON users (is_active);
+DROP INDEX IF EXISTS idx_w_users_last_login_at;
+CREATE INDEX IF NOT EXISTS idx_users_last_login_at ON users (last_login_at);
+DROP INDEX IF EXISTS idx_w_users_created_at;
+CREATE INDEX IF NOT EXISTS idx_users_created_at ON users (created_at);
+
+DROP INDEX IF EXISTS idx_w_auth_sources_is_active;
+CREATE INDEX IF NOT EXISTS idx_auth_sources_is_active ON auth_sources (is_active);
+
+DROP INDEX IF EXISTS idx_w_external_accounts_auth_source_id;
+CREATE INDEX IF NOT EXISTS idx_external_accounts_auth_source_id ON external_accounts (auth_source_id);
+DROP INDEX IF EXISTS idx_w_external_accounts_user_id;
+CREATE INDEX IF NOT EXISTS idx_external_accounts_user_id ON external_accounts (user_id);
+DROP INDEX IF EXISTS idx_w_external_accounts_source_external;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_external_accounts_source_external ON external_accounts (auth_source_id, external_id);
+
+DROP INDEX IF EXISTS idx_w_uploads_user_id;
+CREATE INDEX IF NOT EXISTS idx_uploads_user_id ON uploads (user_id);
+DROP INDEX IF EXISTS idx_w_uploads_file_path;
+CREATE INDEX IF NOT EXISTS idx_uploads_file_path ON uploads (file_path);
+DROP INDEX IF EXISTS idx_w_uploads_hash;
+CREATE INDEX IF NOT EXISTS idx_uploads_hash ON uploads (hash);
+DROP INDEX IF EXISTS idx_w_uploads_type;
+CREATE INDEX IF NOT EXISTS idx_uploads_type ON uploads (type);
+
+DROP INDEX IF EXISTS idx_w_access_tokens_user_id;
+CREATE INDEX IF NOT EXISTS idx_access_tokens_user_id ON access_tokens (user_id);
+
+DROP INDEX IF EXISTS idx_w_task_executions_task_type;
+CREATE INDEX IF NOT EXISTS idx_task_executions_task_type ON task_executions (task_type);
+DROP INDEX IF EXISTS idx_w_task_executions_status;
+CREATE INDEX IF NOT EXISTS idx_task_executions_status ON task_executions (status);
+DROP INDEX IF EXISTS idx_w_task_executions_started_at;
+CREATE INDEX IF NOT EXISTS idx_task_executions_started_at ON task_executions (started_at);
+DROP INDEX IF EXISTS idx_w_task_executions_created_at;
+CREATE INDEX IF NOT EXISTS idx_task_executions_created_at ON task_executions (created_at);
+
+DROP INDEX IF EXISTS idx_w_templates_is_system;
+CREATE INDEX IF NOT EXISTS idx_templates_is_system ON templates (is_system);
+DROP INDEX IF EXISTS idx_w_templates_created_at;
+CREATE INDEX IF NOT EXISTS idx_templates_created_at ON templates (created_at);
+DROP INDEX IF EXISTS idx_w_templates_updated_at;
+CREATE INDEX IF NOT EXISTS idx_templates_updated_at ON templates (updated_at);
+
+DROP INDEX IF EXISTS idx_w_schedules_is_active;
+CREATE INDEX IF NOT EXISTS idx_schedules_is_active ON schedules (is_active);

internal/infra/persistence/migrator/goose/sqlite/202606110004_add_file_access_whitelist_config.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES ('file_access_whitelist', '["avatar"]', 'system', 1, '免登录访问的文件业务类型白名单 (JSON 数组格式)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'file_access_whitelist';

internal/infra/persistence/migrator/goose/sqlite/202606110005_add_disk_cache_configs.sql

@@ -0,0 +1,10 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES 
+  ('disk_cache_max_size_mb', '100', 'system', 0, '磁盘缓存最大空间大小 (MB)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('disk_cache_ttl_minutes', '60', 'system', 0, '磁盘缓存默认有效期 (分钟)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP),
+  ('disk_cache_lru_enabled', 'true', 'system', 0, '是否启用 LRU 淘汰机制', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key IN ('disk_cache_max_size_mb', 'disk_cache_ttl_minutes', 'disk_cache_lru_enabled');

internal/infra/persistence/migrator/goose/sqlite/202606120001_add_login_session_ttl_config.sql

@@ -0,0 +1,8 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES 
+  ('login_session_ttl_hours', '0', 'system', 0, '登录会话过期时间 (小时，0表示浏览器关闭后自动退出，-1表示永不过期)', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'login_session_ttl_hours';

internal/infra/persistence/migrator/goose/sqlite/202606120002_add_update_upstream_repository_config.sql

@@ -0,0 +1,7 @@
+-- +goose Up
+INSERT INTO w_system_configs (key, value, type, visibility, description, created_at, updated_at)
+VALUES ('update_upstream_repository', 'Rain-kl/OpenFlare', 'system', 0, 'GitHub Actions Release 上游仓库（owner/repo 或 GitHub 仓库地址）', CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+ON CONFLICT (key) DO NOTHING;
+
+-- +goose Down
+DELETE FROM w_system_configs WHERE key = 'update_upstream_repository';