merge: maestro/tsk_rBPr0Xuy10bz [tsk_rBPr0Xuy10bz] 探针汇聚入口 + Redis 探针存储 (tsk_eu2qVvni1HJR)

Manually apply changes from maestro/tsk_rBPr0Xuy10bz that could not be
auto-merged due to uncommitted changes on main at merge time.

Added:
- server/internal/scheduler/probe/types.go  – frozen schema types (ReportRequest,
  VantagePoint, NodeReport, L1/L2/L3Result, ProbeSnapshot)
- server/internal/scheduler/probe/store.go  – Redis Store: SaveReports, CheckAndMarkSeen,
  SnapshotsByNode, AliveProbes with TTL constants and key-schema docs
- server/internal/scheduler/probe/ingest.go – IngestHandler (POST /probe/report),
  HMAC-SHA256 auth + timestamp window + replay prevention via SetNX
- server/internal/scheduler/probe/ingest_test.go – 17 tests (auth failures, integration,
  Store unit tests); all pass with miniredis

Updated:
- server/cmd/server/main.go – register /probe/report route when PROBE_SECRETS env is set

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/cmd/server/main.go

@@ -9,6 +9,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
+	"github.com/wangjia/pangolin/server/internal/redisutil"
+	"github.com/wangjia/pangolin/server/internal/scheduler/probe"
 )
 
 func main() {
@@ -33,8 +35,43 @@ func main() {
 		_ = json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
 	})
 
+	// --- Probe ingest route (optional) ---
+	// Requires:
+	//   PROBE_SECRETS  – JSON object mapping probeId → HMAC secret, e.g.
+	//                    '{"probe-sg-01":"s3cr3t1","probe-jp-01":"s3cr3t2"}'
+	//   REDIS_ADDR     – Redis address, default 127.0.0.1:6379
+	//   REDIS_PASSWORD – Redis password (optional)
+	//
+	// If PROBE_SECRETS is empty the route is not registered and the server
+	// starts normally without the probe ingest endpoint.
+	probeSecretsJSON := os.Getenv("PROBE_SECRETS")
+	if probeSecretsJSON != "" {
+		redisAddr := getenvDefault("REDIS_ADDR", "127.0.0.1:6379")
+		rdb, err := redisutil.New(redisAddr, os.Getenv("REDIS_PASSWORD"), 0)
+		if err != nil {
+			log.Printf("probe: redis connect failed (%v) – probe route disabled", err)
+		} else {
+			var secretMap map[string]string
+			if err := json.Unmarshal([]byte(probeSecretsJSON), &secretMap); err != nil {
+				log.Fatalf("probe: invalid PROBE_SECRETS JSON: %v", err)
+			}
+			reg := probe.NewMapRegistry(secretMap)
+			st := probe.NewStore(rdb)
+			h := probe.NewIngestHandler(reg, st)
+			r.Post("/probe/report", h.ServeHTTP)
+			log.Printf("probe ingest route registered (%d probe(s))", len(secretMap))
+		}
+	}
+
 	log.Printf("pangolin server listening on %s", *addr)
 	if err := http.ListenAndServe(*addr, r); err != nil {
 		log.Fatalf("server error: %v", err)
 	}
 }
+
+func getenvDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}