feat(api): require bearer authentication and unify response contracts

deploy/nginx/raw.134333.xyz.conf

@@ -1,3 +1,12 @@
+# 票据属于资源凭据，日志保留资源路径但不记录明文票据。
+map $uri $rawmark_log_path {
+  ~^/api/v1/resources/[^/]+(?<rawmark_resource_suffix>/.*)$ /api/v1/resources/[redacted]$rawmark_resource_suffix;
+  default $uri;
+}
+log_format rawmark '$remote_addr - $remote_user [$time_local] '
+                   '"$request_method $rawmark_log_path $server_protocol" $status $body_bytes_sent '
+                   '"$http_user_agent"';
+
 # raw.134333.xyz -> RawMark 容器（127.0.0.1:21000）
 
 server {
@@ -12,7 +21,7 @@ server {
 
   include /etc/nginx/snippets/ssl-134333.xyz.conf;
   include /etc/nginx/snippets/no-spider.conf;
-  access_log /var/log/nginx/raw.134333.xyz.log;
+  access_log /var/log/nginx/raw.134333.xyz.log rawmark;
   error_log /var/log/nginx/raw.134333.xyz.error.log warn;
 
   location / {
@@ -26,5 +35,11 @@ server {
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_read_timeout 1h;
+
+    # Nginx 错误日志不能脱敏请求行；票据路径只保留脱敏访问日志和应用错误日志。
+    location ^~ /api/v1/resources/ {
+      proxy_pass http://127.0.0.1:21000;
+      error_log /dev/null;
+    }
   }
 }