refactor(repository): 收敛 model/repository 分层为唯一持久化入口

将 OpenFlare 与平台业务的数据访问从 model 与 apps 直连迁入 repository，
model 仅保留实体与无 IO 规则；补充 code-check 架构守卫与开发规范。

internal/apps/openflare/tls/acme_obtain_test.go

@@ -9,6 +9,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -81,7 +83,7 @@ func TestRenewCertificateSetsApplying(t *testing.T) {
 		CertPEM:       " ",
 		KeyPEM:        " ",
 	}
-	require.NoError(t, model.CreateTLSCertificateRecord(ctx, cert))
+	require.NoError(t, repository.CreateTLSCertificateRecord(ctx, cert))
 
 	restore := SetObtainCertificateFuncForTest(func(ctx context.Context, c *model.TLSCertificate) error {
 		return nil
@@ -106,19 +108,19 @@ func TestConvertCertificateToACMEPreservesUploadOnFailure(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	stored, err := model.GetTLSCertificateByID(ctx, cert.ID)
+	stored, err := repository.GetTLSCertificateByID(ctx, cert.ID)
 	require.NoError(t, err)
 	originalStoredCertPEM := stored.CertPEM
 	originalStoredKeyPEM := stored.KeyPEM
 
 	stored.ApplyStatus = "applying"
 	stored.PrimaryDomain = "manual.example.com"
-	require.NoError(t, model.SaveTLSCertificate(ctx, stored))
+	require.NoError(t, repository.SaveTLSCertificate(ctx, stored))
 
 	err = updateCertError(ctx, stored, "dns challenge failed")
 	require.Error(t, err)
 
-	finalCert, err := model.GetTLSCertificateByID(ctx, cert.ID)
+	finalCert, err := repository.GetTLSCertificateByID(ctx, cert.ID)
 	require.NoError(t, err)
 	assert.Equal(t, "upload", finalCert.Provider)
 	assert.Equal(t, "error", finalCert.ApplyStatus)
@@ -141,14 +143,14 @@ func TestConvertCertificateToACMERejectsInvalidStates(t *testing.T) {
 	require.NoError(t, err)
 
 	cert.Provider = "acme"
-	require.NoError(t, model.SaveTLSCertificate(ctx, cert))
+	require.NoError(t, repository.SaveTLSCertificate(ctx, cert))
 	_, err = ConvertCertificateToACME(ctx, cert.ID, ApplyInput{Name: "manual-cert"})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "only uploaded")
 
 	cert.Provider = "upload"
 	cert.ApplyStatus = "applying"
-	require.NoError(t, model.SaveTLSCertificate(ctx, cert))
+	require.NoError(t, repository.SaveTLSCertificate(ctx, cert))
 	_, err = ConvertCertificateToACME(ctx, cert.ID, ApplyInput{Name: "manual-cert"})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "already applying")

internal/apps/openflare/tls/logics.go

@@ -12,6 +12,8 @@ import (
 	"mime/multipart"
 	"strings"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
 	"github.com/Rain-kl/Wavelet/internal/model"
 )
@@ -71,17 +73,17 @@ type DNSAccountInput struct {
 
 // ListCertificates 列出全部证书（不含 PEM）。
 func ListCertificates(ctx context.Context) ([]model.TLSCertificate, error) {
-	return model.ListTLSCertificates(ctx)
+	return repository.ListTLSCertificates(ctx)
 }
 
 // GetCertificate 获取证书详情（不含 PEM）。
 func GetCertificate(ctx context.Context, id uint) (*model.TLSCertificate, error) {
-	return model.GetTLSCertificateByID(ctx, id)
+	return repository.GetTLSCertificateByID(ctx, id)
 }
 
 // GetCertificateContent 获取证书 PEM 内容。
 func GetCertificateContent(ctx context.Context, id uint) (*CertificateContent, error) {
-	certificate, err := model.GetTLSCertificateByID(ctx, id)
+	certificate, err := repository.GetTLSCertificateByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -117,7 +119,7 @@ func CreateCertificate(ctx context.Context, input CertificateInput) (*model.TLSC
 	if err != nil {
 		return nil, err
 	}
-	if err = model.CreateTLSCertificateRecord(ctx, certificate); err != nil {
+	if err = repository.CreateTLSCertificateRecord(ctx, certificate); err != nil {
 		if isUniqueConstraintError(err) {
 			return nil, errors.New(errCertificateNameExists)
 		}
@@ -149,7 +151,7 @@ func CreateCertificateFromFiles(ctx context.Context, name string, certFile *mult
 
 // UpdateCertificate 更新上传证书。
 func UpdateCertificate(ctx context.Context, id uint, input CertificateInput) (*model.TLSCertificate, error) {
-	existing, err := model.GetTLSCertificateByID(ctx, id)
+	existing, err := repository.GetTLSCertificateByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -157,7 +159,7 @@ func UpdateCertificate(ctx context.Context, id uint, input CertificateInput) (*m
 	if err != nil {
 		return nil, err
 	}
-	if err = model.SaveTLSCertificate(ctx, certificate); err != nil {
+	if err = repository.SaveTLSCertificate(ctx, certificate); err != nil {
 		if isUniqueConstraintError(err) {
 			return nil, errors.New(errCertificateNameExists)
 		}
@@ -171,10 +173,10 @@ func DeleteCertificate(ctx context.Context, id uint) error {
 	if err := ensureCertificateNotReferenced(ctx, id); err != nil {
 		return err
 	}
-	if _, err := model.GetTLSCertificateByID(ctx, id); err != nil {
+	if _, err := repository.GetTLSCertificateByID(ctx, id); err != nil {
 		return err
 	}
-	return model.DeleteTLSCertificateRecord(ctx, id)
+	return repository.DeleteTLSCertificateRecord(ctx, id)
 }
 
 // ApplyCertificate 申请 ACME 证书。
@@ -188,7 +190,7 @@ func ApplyCertificate(ctx context.Context, input ApplyInput) (*model.TLSCertific
 	if cert.Name == "" {
 		return nil, errors.New(errCertificateNameRequired)
 	}
-	if err := model.CreateTLSCertificateRecord(ctx, cert); err != nil {
+	if err := repository.CreateTLSCertificateRecord(ctx, cert); err != nil {
 		if isUniqueConstraintError(err) {
 			return nil, errors.New(errCertificateNameExists)
 		}
@@ -205,7 +207,7 @@ func ApplyCertificate(ctx context.Context, input ApplyInput) (*model.TLSCertific
 
 // UpdateACMECertificate 更新 ACME 证书配置。
 func UpdateACMECertificate(ctx context.Context, id uint, input ApplyInput) (*model.TLSCertificate, error) {
-	cert, err := model.GetTLSCertificateByID(ctx, id)
+	cert, err := repository.GetTLSCertificateByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -216,7 +218,7 @@ func UpdateACMECertificate(ctx context.Context, id uint, input ApplyInput) (*mod
 	if cert.Name == "" {
 		return nil, errors.New(errCertificateNameRequired)
 	}
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		if isUniqueConstraintError(err) {
 			return nil, errors.New(errCertificateNameExists)
 		}
@@ -233,7 +235,7 @@ func UpdateACMECertificate(ctx context.Context, id uint, input ApplyInput) (*mod
 
 // ConvertCertificateToACME 将上传证书转为 ACME 管理。
 func ConvertCertificateToACME(ctx context.Context, id uint, input ApplyInput) (*model.TLSCertificate, error) {
-	cert, err := model.GetTLSCertificateByID(ctx, id)
+	cert, err := repository.GetTLSCertificateByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +250,7 @@ func ConvertCertificateToACME(ctx context.Context, id uint, input ApplyInput) (*
 		return nil, errors.New(errCertificateNameRequired)
 	}
 	cert.ApplyMessage = ""
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		if isUniqueConstraintError(err) {
 			return nil, errors.New(errCertificateNameExists)
 		}
@@ -260,14 +262,14 @@ func ConvertCertificateToACME(ctx context.Context, id uint, input ApplyInput) (*
 		if err := obtainTLSCertificate(asyncCtx, c); err != nil {
 			return
 		}
-		latest, err := model.GetTLSCertificateByID(asyncCtx, c.ID)
+		latest, err := repository.GetTLSCertificateByID(asyncCtx, c.ID)
 		if err != nil {
 			return
 		}
 		latest.Provider = tlsProviderACME
 		latest.ApplyStatus = tlsApplyStatusReady
 		latest.ApplyMessage = ""
-		_ = model.SaveTLSCertificate(asyncCtx, latest)
+		_ = repository.SaveTLSCertificate(asyncCtx, latest)
 	}(cert)
 
 	return sanitizeCertificateForResponse(cert), nil
@@ -275,7 +277,7 @@ func ConvertCertificateToACME(ctx context.Context, id uint, input ApplyInput) (*
 
 // RenewCertificate 续期 ACME 证书。
 func RenewCertificate(ctx context.Context, id uint) (*model.TLSCertificate, error) {
-	cert, err := model.GetTLSCertificateByID(ctx, id)
+	cert, err := repository.GetTLSCertificateByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -295,7 +297,7 @@ func RenewCertificate(ctx context.Context, id uint) (*model.TLSCertificate, erro
 
 	cert.ApplyStatus = tlsApplyStatusApplying
 	cert.ApplyMessage = ""
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		return nil, err
 	}
 	return sanitizeCertificateForResponse(cert), nil
@@ -303,7 +305,7 @@ func RenewCertificate(ctx context.Context, id uint) (*model.TLSCertificate, erro
 
 // ListDNSAccounts 列出 DNS 账号。
 func ListDNSAccounts(ctx context.Context) ([]model.DNSAccount, error) {
-	return model.ListDNSAccounts(ctx)
+	return repository.ListDNSAccounts(ctx)
 }
 
 // CreateDNSAccount 创建 DNS 账号。
@@ -320,7 +322,7 @@ func CreateDNSAccount(ctx context.Context, input DNSAccountInput) (*model.DNSAcc
 	if account.Name == "" || account.Type == "" || authorization == "" {
 		return nil, errors.New("DNS 账号参数不完整")
 	}
-	if err := model.CreateDNSAccountRecord(ctx, account); err != nil {
+	if err := repository.CreateDNSAccountRecord(ctx, account); err != nil {
 		return nil, err
 	}
 	return sanitizeDNSAccountForResponse(account), nil
@@ -328,7 +330,7 @@ func CreateDNSAccount(ctx context.Context, input DNSAccountInput) (*model.DNSAcc
 
 // UpdateDNSAccount 更新 DNS 账号。
 func UpdateDNSAccount(ctx context.Context, id uint, input DNSAccountInput) (*model.DNSAccount, error) {
-	account, err := model.GetDNSAccountByID(ctx, id)
+	account, err := repository.GetDNSAccountByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -342,7 +344,7 @@ func UpdateDNSAccount(ctx context.Context, id uint, input DNSAccountInput) (*mod
 	if account.Name == "" || account.Type == "" || authorization == "" {
 		return nil, errors.New("DNS 账号参数不完整")
 	}
-	if err := model.SaveDNSAccount(ctx, account); err != nil {
+	if err := repository.SaveDNSAccount(ctx, account); err != nil {
 		return nil, err
 	}
 	return sanitizeDNSAccountForResponse(account), nil
@@ -350,22 +352,22 @@ func UpdateDNSAccount(ctx context.Context, id uint, input DNSAccountInput) (*mod
 
 // DeleteDNSAccount 删除 DNS 账号。
 func DeleteDNSAccount(ctx context.Context, id uint) error {
-	if _, err := model.GetDNSAccountByID(ctx, id); err != nil {
+	if _, err := repository.GetDNSAccountByID(ctx, id); err != nil {
 		return err
 	}
-	count, err := model.CountTLSCertificatesByDNSAccountID(ctx, id)
+	count, err := repository.CountTLSCertificatesByDNSAccountID(ctx, id)
 	if err != nil {
 		return err
 	}
 	if count > 0 {
 		return errors.New(errDNSAccountInUse)
 	}
-	return model.DeleteDNSAccountRecord(ctx, id)
+	return repository.DeleteDNSAccountRecord(ctx, id)
 }
 
 // GetDefaultAcmeAccount 获取默认 ACME 账号。
 func GetDefaultAcmeAccount(ctx context.Context) (*model.AcmeAccount, error) {
-	account, err := model.GetDefaultAcmeAccount(ctx)
+	account, err := repository.GetDefaultAcmeAccount(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -430,7 +432,7 @@ func fillAcmeCertificateFields(cert *model.TLSCertificate, input ApplyInput) {
 }
 
 func ensureCertificateNotReferenced(ctx context.Context, id uint) error {
-	count, err := model.CountZoneDomainsByCertificateID(ctx, id)
+	count, err := repository.CountZoneDomainsByCertificateID(ctx, id)
 	if err != nil {
 		return err
 	}

internal/apps/openflare/tls/logics_test.go

@@ -16,6 +16,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/infra/config"
 	db "github.com/Rain-kl/Wavelet/internal/infra/persistence"
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
@@ -123,7 +125,7 @@ func TestCreateCertificateEncryptsPrivateKey(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	stored, err := model.GetTLSCertificateByID(ctx, certificate.ID)
+	stored, err := repository.GetTLSCertificateByID(ctx, certificate.ID)
 	require.NoError(t, err)
 	assert.NotEqual(t, keyPEM, stored.KeyPEM)
 	assert.Contains(t, stored.KeyPEM, sensitiveValuePrefix)

internal/apps/openflare/tls/obtain.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/apps/openflare/tls/acme"
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
 	"github.com/Rain-kl/Wavelet/internal/model"
@@ -35,7 +37,7 @@ func SetObtainCertificateFuncForTest(fn func(context.Context, *model.TLSCertific
 func obtainCertificate(ctx context.Context, cert *model.TLSCertificate) error {
 	task.AppendLog(ctx, "【续签任务】开始续签，设置申请状态为 applying...")
 	cert.ApplyStatus = tlsApplyStatusApplying
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		return err
 	}
 
@@ -46,7 +48,7 @@ func obtainCertificate(ctx context.Context, cert *model.TLSCertificate) error {
 	}
 
 	task.AppendLog(ctx, "【续签任务】正在解析 DNS 账户信息 (ID=%d)...", cert.DNSAccountID)
-	dnsAccount, err := model.GetDNSAccountByID(ctx, cert.DNSAccountID)
+	dnsAccount, err := repository.GetDNSAccountByID(ctx, cert.DNSAccountID)
 	if err != nil {
 		return updateCertError(ctx, cert, fmt.Sprintf("Failed to get DNS account: %v", err))
 	}
@@ -100,7 +102,7 @@ func obtainCertificate(ctx context.Context, cert *model.TLSCertificate) error {
 func updateCertError(ctx context.Context, cert *model.TLSCertificate, message string) error {
 	cert.ApplyStatus = "error"
 	cert.ApplyMessage = message
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		return err
 	}
 	return fmt.Errorf("%s", message)

internal/apps/openflare/tls/obtain_helpers.go

@@ -7,21 +7,23 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/apps/openflare/tls/acme"
 	"github.com/Rain-kl/Wavelet/internal/model"
 )
 
 func resolveAcmeAccount(ctx context.Context, cert *model.TLSCertificate) (*model.AcmeAccount, error) {
-	acmeAccount, err := model.GetAcmeAccountByID(ctx, cert.AcmeAccountID)
+	acmeAccount, err := repository.GetAcmeAccountByID(ctx, cert.AcmeAccountID)
 	if err == nil {
 		return acmeAccount, nil
 	}
-	acmeAccount, err = model.GetDefaultAcmeAccount(ctx)
+	acmeAccount, err = repository.GetDefaultAcmeAccount(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get ACME account: %w", err)
 	}
 	cert.AcmeAccountID = acmeAccount.ID
-	if err := model.SaveTLSCertificate(ctx, cert); err != nil {
+	if err := repository.SaveTLSCertificate(ctx, cert); err != nil {
 		return nil, err
 	}
 	return acmeAccount, nil
@@ -49,14 +51,14 @@ func persistAcmeAccountUpdates(
 		acmeAccount.URL = newAccountURL
 	}
 	if acmeAccount.ID == 0 {
-		if dbErr := model.CreateAcmeAccountRecord(ctx, acmeAccount); dbErr != nil {
+		if dbErr := repository.CreateAcmeAccountRecord(ctx, acmeAccount); dbErr != nil {
 			return fmt.Errorf("failed to create ACME account: %w", dbErr)
 		}
-	} else if dbErr := model.SaveAcmeAccount(ctx, acmeAccount); dbErr != nil {
+	} else if dbErr := repository.SaveAcmeAccount(ctx, acmeAccount); dbErr != nil {
 		return fmt.Errorf("failed to save ACME account: %w", dbErr)
 	}
 	cert.AcmeAccountID = acmeAccount.ID
-	return model.SaveTLSCertificate(ctx, cert)
+	return repository.SaveTLSCertificate(ctx, cert)
 }
 
 func saveObtainedCertificate(ctx context.Context, cert *model.TLSCertificate, result *acme.CertificateResult) error {
@@ -70,5 +72,5 @@ func saveObtainedCertificate(ctx context.Context, cert *model.TLSCertificate, re
 	cert.NotAfter = result.NotAfter
 	cert.ApplyStatus = tlsApplyStatusReady
 	cert.ApplyMessage = ""
-	return model.SaveTLSCertificate(ctx, cert)
+	return repository.SaveTLSCertificate(ctx, cert)
 }

internal/apps/openflare/tls/tasks.go

@@ -9,8 +9,9 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
-	"github.com/Rain-kl/Wavelet/internal/model"
 )
 
 const (
@@ -77,7 +78,7 @@ func (h *SSLSingleRenewHandler) Execute(ctx context.Context, payload []byte) (*t
 
 	task.AppendLog(ctx, "开始续期证书，ID: %d", req.ID)
 
-	cert, err := model.GetTLSCertificateByID(ctx, req.ID)
+	cert, err := repository.GetTLSCertificateByID(ctx, req.ID)
 	if err != nil {
 		task.AppendLog(ctx, "获取证书记录失败 ID=%d: %v", req.ID, err)
 		return nil, fmt.Errorf("获取证书记录失败: %w", err)

internal/apps/openflare/tls/tasks_test.go

@@ -9,6 +9,8 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -91,7 +93,7 @@ func TestSSLSingleRenewHandler_Execute(t *testing.T) {
 			Provider:      "custom",
 			PrimaryDomain: "example.com",
 		}
-		err := model.CreateTLSCertificateRecord(ctx, cert)
+		err := repository.CreateTLSCertificateRecord(ctx, cert)
 		require.NoError(t, err)
 
 		payload, err := json.Marshal(SSLSingleRenewPayload{ID: cert.ID})
@@ -108,13 +110,13 @@ func TestSSLSingleRenewHandler_Execute(t *testing.T) {
 			Provider:      tlsProviderACME,
 			PrimaryDomain: "success.example.com",
 		}
-		err := model.CreateTLSCertificateRecord(ctx, cert)
+		err := repository.CreateTLSCertificateRecord(ctx, cert)
 		require.NoError(t, err)
 
 		// Mock obtainCertificate to succeed
 		restore := SetObtainCertificateFuncForTest(func(ctx context.Context, c *model.TLSCertificate) error {
 			c.ApplyStatus = tlsApplyStatusReady
-			return model.SaveTLSCertificate(ctx, c)
+			return repository.SaveTLSCertificate(ctx, c)
 		})
 		defer restore()
 
@@ -125,7 +127,7 @@ func TestSSLSingleRenewHandler_Execute(t *testing.T) {
 		require.NoError(t, err)
 		assert.Contains(t, res.Message, "续签成功")
 
-		updated, err := model.GetTLSCertificateByID(ctx, cert.ID)
+		updated, err := repository.GetTLSCertificateByID(ctx, cert.ID)
 		require.NoError(t, err)
 		assert.Equal(t, tlsApplyStatusReady, updated.ApplyStatus)
 	})
@@ -136,7 +138,7 @@ func TestSSLSingleRenewHandler_Execute(t *testing.T) {
 			Provider:      tlsProviderACME,
 			PrimaryDomain: "fail.example.com",
 		}
-		err := model.CreateTLSCertificateRecord(ctx, cert)
+		err := repository.CreateTLSCertificateRecord(ctx, cert)
 		require.NoError(t, err)
 
 		// Mock obtainCertificate to fail