refactor(repo): consolidate openflare-server to root and move subprojects to internal/apps

- Merge all files inside openflare-server to the repository root directory.
- Relocate agent, relay, and flared subprojects from internal/ to internal/apps/.
- Combine docker-compose files and update build context paths to root.
- Update GitHub workflows and Dockerfiles to refer to new directories and package names.
- Rewrite Go package imports across all files.
- Resolve database renew test race condition and clean up docs.

internal/apps/openflare/apiutil/bind.go

@@ -0,0 +1,39 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package apiutil provides HTTP helpers for OpenFlare v1 custom API handlers.
+package apiutil
+
+import (
+	"strconv"
+
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/gin-gonic/gin"
+)
+
+const errInvalidParams = "参数错误"
+const errInvalidID = "无效的 ID"
+
+// BindJSON binds JSON body; returns false after aborting with 400.
+func BindJSON(c *gin.Context, dst any) bool {
+	if err := c.ShouldBindJSON(dst); err != nil {
+		response.AbortBadRequest(c, errInvalidParams)
+		return false
+	}
+	return true
+}
+
+// IDParam parses :id from the URL path.
+func IDParam(c *gin.Context) (uint, bool) {
+	raw := c.Param("id")
+	if raw == "" {
+		response.AbortBadRequest(c, errInvalidID)
+		return 0, false
+	}
+	id64, err := strconv.ParseUint(raw, 10, 64)
+	if err != nil || id64 == 0 {
+		response.AbortBadRequest(c, errInvalidID)
+		return 0, false
+	}
+	return uint(id64), true
+}

internal/apps/openflare/apiutil/errors.go

@@ -0,0 +1,34 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package apiutil
+
+import (
+	"errors"
+
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// AbortNotFoundIfMissing maps gorm.ErrRecordNotFound to 404; other errors to 400.
+func AbortNotFoundIfMissing(c *gin.Context, err error, notFoundMsg string) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		response.AbortNotFound(c, notFoundMsg)
+		return true
+	}
+	response.AbortBadRequest(c, err.Error())
+	return true
+}
+
+// AbortBadRequestOnError writes a 400 for any non-nil error.
+func AbortBadRequestOnError(c *gin.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+	response.AbortBadRequest(c, err.Error())
+	return true
+}

internal/apps/openflare/apiutil/middleware.go

@@ -0,0 +1,17 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package apiutil
+
+import (
+	"github.com/Rain-kl/Wavelet/internal/apps/admin"
+	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
+	"github.com/gin-gonic/gin"
+)
+
+// AdminMiddlewares returns Wavelet-standard middlewares for OpenFlare console routes.
+// OpenFlare no longer distinguishes Admin vs Root tiers; all management endpoints share
+// the same gate: user.IsAdmin for session users, token_admin for Access Token callers.
+func AdminMiddlewares() []gin.HandlerFunc {
+	return []gin.HandlerFunc{oauth.LoginRequired(), admin.LoginAdminRequired()}
+}

internal/apps/openflare/apiutil/middleware_test.go

@@ -0,0 +1,158 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package apiutil
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/admin"
+	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
+	"github.com/Rain-kl/Wavelet/internal/common/response"
+	"github.com/Rain-kl/Wavelet/internal/config"
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/testhelper"
+	"github.com/gin-contrib/sessions"
+	"github.com/gin-contrib/sessions/cookie"
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupAdminMiddlewareTest(t *testing.T) (*gin.Engine, *gorm.DB, func()) {
+	t.Helper()
+
+	dbConn, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, dbConn.AutoMigrate(&model.User{}, &model.AccessToken{}))
+	db.SetDB(dbConn)
+
+	sessionCookieName := "test_admin_middleware_session"
+	if config.Config.App.SessionCookieName != "" {
+		sessionCookieName = config.Config.App.SessionCookieName
+	}
+	store := cookie.NewStore([]byte("test_admin_middleware_session_secret"))
+	store.Options(oauth.GetSessionOptions(3600))
+	engine := testhelper.NewTestGinEngine(sessions.Sessions(sessionCookieName, store))
+	protected := engine.Group("/protected", AdminMiddlewares()...)
+	protected.GET("", func(c *gin.Context) {
+		c.JSON(http.StatusOK, response.OK(gin.H{"ok": true}))
+	})
+
+	cleanup := func() {
+		db.SetDB(nil)
+	}
+
+	return engine, dbConn, cleanup
+}
+
+func seedUser(t *testing.T, dbConn *gorm.DB, username string, isAdmin bool) *model.User {
+	t.Helper()
+
+	user := &model.User{
+		ID:       idgen.NextUint64ID(),
+		Username: username,
+		Nickname: username,
+		Email:    username + "@openflare.test",
+		IsActive: true,
+		IsAdmin:  isAdmin,
+	}
+	require.NoError(t, dbConn.Create(user).Error)
+	return user
+}
+
+func seedAccessToken(t *testing.T, dbConn *gorm.DB, user *model.User, isAdmin bool) string {
+	t.Helper()
+
+	token, err := model.GenerateTokenString()
+	require.NoError(t, err)
+	require.NoError(t, dbConn.Create(&model.AccessToken{
+		UserID:      user.ID,
+		Name:        user.Username + "-token",
+		TokenHash:   model.HashToken(token),
+		MaskedToken: model.MaskTokenString(token),
+		IsAdmin:     isAdmin,
+	}).Error)
+	return token
+}
+
+func decodeResponse(t *testing.T, rec *httptest.ResponseRecorder) response.Any {
+	t.Helper()
+
+	var resp response.Any
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
+	return resp
+}
+
+func TestAdminRequiredUnauthenticated(t *testing.T) {
+	engine, _, cleanup := setupAdminMiddlewareTest(t)
+	defer cleanup()
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	engine.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusUnauthorized, rec.Code)
+	resp := decodeResponse(t, rec)
+	assert.NotEmpty(t, resp.ErrorMsg)
+}
+
+func TestAdminRequiredNonAdminToken(t *testing.T) {
+	engine, dbConn, cleanup := setupAdminMiddlewareTest(t)
+	defer cleanup()
+
+	user := seedUser(t, dbConn, "regular", false)
+	token := seedAccessToken(t, dbConn, user, false)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	req.Header.Set("X-Access-Token", token)
+	engine.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code)
+	resp := decodeResponse(t, rec)
+	assert.Equal(t, admin.TokenAdminRequired, resp.ErrorMsg)
+}
+
+func TestAdminRequiredAdminWithoutTokenAdmin(t *testing.T) {
+	engine, dbConn, cleanup := setupAdminMiddlewareTest(t)
+	defer cleanup()
+
+	user := seedUser(t, dbConn, "admin-no-token-admin", true)
+	token := seedAccessToken(t, dbConn, user, false)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	req.Header.Set("X-Access-Token", token)
+	engine.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusNotFound, rec.Code)
+	resp := decodeResponse(t, rec)
+	assert.Equal(t, admin.TokenAdminRequired, resp.ErrorMsg)
+}
+
+func TestAdminRequiredAdminWithTokenAdmin(t *testing.T) {
+	engine, dbConn, cleanup := setupAdminMiddlewareTest(t)
+	defer cleanup()
+
+	user := seedUser(t, dbConn, "admin", true)
+	token := seedAccessToken(t, dbConn, user, true)
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/protected", nil)
+	req.Header.Set("X-Access-Token", token)
+	engine.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	resp := decodeResponse(t, rec)
+	assert.Empty(t, resp.ErrorMsg)
+}

internal/apps/openflare/apiutil/routes.go

@@ -0,0 +1,19 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package apiutil
+
+import (
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// RegisterCollection registers a collection endpoint on both "" and "/" so requests
+// work with or without a trailing slash.
+func RegisterCollection(route *gin.RouterGroup, method string, handlers ...gin.HandlerFunc) {
+	route.Handle(method, "/", handlers...)
+	if !strings.HasSuffix(route.BasePath(), "/") {
+		route.Handle(method, "", handlers...)
+	}
+}