Align backend authentication and API response contracts

Replace cookie authentication with revocable Bearer sessions, optional one-use PNG challenges, bounded login limits, and short-lived market WebSocket tickets. Keep captcha disabled by default.

Standardize ordinary JSON responses while preserving HTTP statuses, raw OpenAPI, redirects, SSE, and WebSocket semantics. Revoke long connections with their owning session.

Expose official calendar data and collector status to the frontend and research tools, support bilingual news topics, and keep summaries and forward-only labels explicit. Verify the staged snapshot with all 305 backend tests.

backend/src/alphapulse/api/main.py

@@ -1,12 +1,22 @@
 from fastapi import Depends, FastAPI
-from fastapi.openapi.docs import get_swagger_ui_html
-from fastapi.responses import HTMLResponse
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import RedirectResponse
+from starlette.exceptions import HTTPException
 
-from alphapulse.api import auth, chat, crawler, market, news, settings, skills, trading
+from alphapulse.api import auth, calendar, chat, crawler, market, news, settings, skills, trading
+from alphapulse.api.response import (
+    ApiResponse, ValidationErrors, http_error, internal_error, success, validation_error,
+)
 from alphapulse.core.auth import require_admin
 
 # 关闭默认文档路由，改为登录后才能访问
-app = FastAPI(title="AlphaPulse", docs_url=None, redoc_url=None, openapi_url=None)
+app = FastAPI(
+    title="AlphaPulse", docs_url=None, redoc_url=None, openapi_url=None,
+    responses={422: {"model": ApiResponse[ValidationErrors], "description": "请求参数无效"}},
+)
+app.add_exception_handler(HTTPException, http_error)
+app.add_exception_handler(RequestValidationError, validation_error)
+app.add_exception_handler(Exception, internal_error)
 app.include_router(auth.router)
 app.include_router(news.router)
 app.include_router(crawler.router)
@@ -16,11 +26,12 @@ app.include_router(settings.router)
 app.include_router(skills.router)
 app.include_router(chat.router)
 app.include_router(trading.router)
+app.include_router(calendar.router)
 
 
 @app.get("/api/health", include_in_schema=False)
-async def health() -> dict[str, str]:
-    return {"status": "ok"}
+async def health() -> ApiResponse[dict[str, str]]:
+    return success({"status": "ok"})
 
 
 @app.get("/api/openapi.json", include_in_schema=False, dependencies=[Depends(require_admin)])
@@ -28,6 +39,6 @@ async def openapi() -> dict:
     return app.openapi()
 
 
-@app.get("/api/docs", include_in_schema=False, dependencies=[Depends(require_admin)])
-async def docs() -> HTMLResponse:
-    return get_swagger_ui_html(openapi_url="/api/openapi.json", title="AlphaPulse API")
+@app.get("/api/docs", include_in_schema=False)
+async def docs() -> RedirectResponse:
+    return RedirectResponse("/docs")