refactor(openflare): migrate console APIs to v1 and centralize routing

Move OpenFlare management endpoints to /api/v1/custom/openflare with
Wavelet response envelopes and Abort* error handling. Keep agent, relay,
and flared protocol routes on /api/* with the legacy compat format.

- Add apiutil helpers and Swagger annotations for console handlers
- Register all OpenFlare routes in internal/router/openflare (not apps)
- Switch frontend services to OpenFlareBaseService and v1 paths
- Remove dead auth/compat code and legacy-base.service.ts
- Update integration tests and changelog

Wavelet/internal/apps/openflare/compat/auth.go

@@ -1,81 +0,0 @@
-// Copyright 2026 Arctel.net
-// SPDX-License-Identifier: Apache-2.0
-
-package compat
-
-import (
-	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
-	"github.com/Rain-kl/Wavelet/internal/model"
-	"github.com/gin-gonic/gin"
-)
-
-const openFlareTokenHeader = "OpenFlare-Token"
-
-// Role constants mirror legacy OpenFlare role values.
-const (
-	RoleCommonUser = 1
-	RoleAdminUser  = 10
-	RoleRootUser   = 100
-)
-
-// RequireRole ensures the caller is authenticated with at least minRole.
-// Phase 1: supports Wavelet session/access-token via oauth.GetUserFromRequest.
-func RequireRole(minRole int) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		user, err := oauth.GetUserFromRequest(c)
-		if err != nil || user == nil {
-			Unauthorized(c, "无权进行此操作，未登录或 token 无效")
-			c.Abort()
-			return
-		}
-		role := resolveRole(c, user)
-		if role < minRole {
-			Fail(c, "无权进行此操作，权限不足")
-			c.Abort()
-			return
-		}
-		c.Set("of_user_id", user.ID)
-		c.Set("of_role", role)
-		c.Set("of_is_admin", user.IsAdmin)
-		c.Next()
-	}
-}
-
-// UserAuth requires role >= CommonUser.
-func UserAuth() gin.HandlerFunc { return RequireRole(RoleCommonUser) }
-
-// AdminAuth requires role >= AdminUser.
-func AdminAuth() gin.HandlerFunc { return RequireRole(RoleAdminUser) }
-
-// RootAuth requires role >= RootUser.
-func RootAuth() gin.HandlerFunc { return RequireRole(RoleRootUser) }
-
-func resolveRole(c *gin.Context, user *model.User) int {
-	if user == nil {
-		return 0
-	}
-	if tokenAdmin, ok := oauth.GetFromContext[bool](c, oauth.TokenAdminKey); ok && tokenAdmin {
-		return RoleRootUser
-	}
-	if user.IsAdmin {
-		return RoleRootUser
-	}
-	return RoleCommonUser
-}
-
-// OpenFlareTokenHeader returns the legacy auth header name.
-func OpenFlareTokenHeader() string {
-	return openFlareTokenHeader
-}
-
-// BridgeOpenFlareToken maps OpenFlare-Token to X-Access-Token for legacy clients.
-func BridgeOpenFlareToken() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		if c.GetHeader("X-Access-Token") == "" {
-			if token := c.GetHeader(openFlareTokenHeader); token != "" {
-				c.Request.Header.Set("X-Access-Token", token)
-			}
-		}
-		c.Next()
-	}
-}

Wavelet/internal/apps/openflare/compat/routes.go

@@ -1,23 +0,0 @@
-// Copyright 2026 Arctel.net
-// SPDX-License-Identifier: Apache-2.0
-
-package compat
-
-import (
-	"strings"
-
-	"github.com/gin-gonic/gin"
-)
-
-// RegisterCollection registers a collection endpoint on both "" and "/" so requests
-// work with or without a trailing slash. This avoids 301/308 redirect loops between
-// Next.js dev proxy and Gin when paths disagree on trailing slashes.
-//
-// When the group base already ends with "/" (e.g. userGroup.Group("/")), only "/" is
-// registered to avoid duplicate route panic.
-func RegisterCollection(route *gin.RouterGroup, method string, handlers ...gin.HandlerFunc) {
-	route.Handle(method, "/", handlers...)
-	if !strings.HasSuffix(route.BasePath(), "/") {
-		route.Handle(method, "", handlers...)
-	}
-}