feat: 增强SaaS后端功能与安全性

refactor: 重构数据库连接使用PostgreSQL替代SQLite
feat(auth): 增加JWT验证的audience和issuer检查
feat(crypto): 添加AES-256-GCM字段加密支持
feat(api): 集成utoipa实现OpenAPI文档
fix(admin): 修复配置项表单验证逻辑
style: 统一代码格式与类型定义
docs: 更新技术栈文档说明PostgreSQL

desktop/src/lib/gateway-storage.ts

@@ -40,15 +40,47 @@ export function isLocalhost(url: string): boolean {
   }
 }
 
+// === Port Constants ===
+
+/** Default gRPC/HTTP port used by the ZCLAW kernel */
+export const ZCLAW_GRPC_PORT = 50051;
+
+/** Legacy/alternative port used in development or older configurations */
+export const ZCLAW_LEGACY_PORT = 4200;
+
+// === Connection Mode ===
+
+/**
+ * Determines how the client connects to the ZCLAW gateway.
+ * - `rest`:  Kernel exposes an HTTP REST API (gRPC-gateway). Used when the
+ *            URL contains a known kernel port.
+ * - `ws`:    Direct WebSocket connection to the kernel.
+ */
+export type ConnectionMode = 'rest' | 'ws';
+
+/**
+ * Decide the connection mode based on the gateway URL.
+ *
+ * When the URL contains a known kernel port (gRPC or legacy), the client
+ * routes requests through the REST adapter instead of opening a raw
+ * WebSocket.
+ */
+export function detectConnectionMode(url: string): ConnectionMode {
+  if (url.includes(`:${ZCLAW_GRPC_PORT}`) || url.includes(`:${ZCLAW_LEGACY_PORT}`)) {
+    return 'rest';
+  }
+  return 'ws';
+}
+
 // === URL Constants ===
 
 // ZCLAW endpoints (port 50051 - actual running port)
 // Note: REST API uses relative path to leverage Vite proxy for CORS bypass
-export const DEFAULT_GATEWAY_URL = `${DEFAULT_WS_PROTOCOL}127.0.0.1:50051/ws`;
+export const DEFAULT_GATEWAY_URL = `${DEFAULT_WS_PROTOCOL}127.0.0.1:${ZCLAW_GRPC_PORT}/ws`;
 export const REST_API_URL = ''; // Empty = use relative path (Vite proxy)
 export const FALLBACK_GATEWAY_URLS = [
   DEFAULT_GATEWAY_URL,
-  `${DEFAULT_WS_PROTOCOL}127.0.0.1:4200/ws`,
+  `${DEFAULT_WS_PROTOCOL}127.0.0.1:${ZCLAW_LEGACY_PORT}/ws`,
 ];
 
 const GATEWAY_URL_STORAGE_KEY = 'zclaw_gateway_url';