fix: P0 panic风险修复 + P1编译warnings清零 + P2代码/文档清理

P0 安全性:
- account/handlers.rs: .unwrap() → .expect() 语义化错误信息
- relay/handlers.rs: SSE Response .unwrap() → .expect()

P1 编译质量 (6 warnings → 0):
- kernel.rs: 移除未使用的 Capability import 和 config_clone 变量
- pipeline_commands.rs: 未使用变量 id → _id
- db.rs: 移除多余括号
- relay/service.rs: 移除未使用的 StreamExt import
- telemetry/service.rs: 抑制 param_idx 未读赋值警告
- main.rs: TcpKeepalive::with_retries() Linux-only 条件编译

P2 代码清理:
- 移除 handStore/HandsPanel/HandTaskPanel/gateway-api/SchedulerPanel 调试 console.log
- SchedulerPanel: 修复 updateWorkflow 未解构导致 TS 编译错误
- 文档清理 zclaw-channels 已移除 crate 的引用

crates/zclaw-saas/src/account/handlers.rs

@@ -185,12 +185,12 @@ pub async fn dashboard_stats(
     // 查询 2: 今日中转统计 — 使用范围查询走 B-tree 索引
     let today_start = chrono::Utc::now()
         .date_naive()
-        .and_hms_opt(0, 0, 0).unwrap()
+        .and_hms_opt(0, 0, 0).expect("midnight is always valid")
         .and_utc()
         .to_rfc3339();
     let tomorrow_start = (chrono::Utc::now() + chrono::Duration::days(1))
         .date_naive()
-        .and_hms_opt(0, 0, 0).unwrap()
+        .and_hms_opt(0, 0, 0).expect("midnight is always valid")
         .and_utc()
         .to_rfc3339();
     let today_row: DashboardTodayRow = sqlx::query_as(

crates/zclaw-saas/src/db.rs

@@ -9,11 +9,11 @@ const SCHEMA_VERSION: i32 = 6;
 /// 初始化数据库
 pub async fn init_db(database_url: &str) -> SaasResult<PgPool> {
     let pool = PgPoolOptions::new()
-        .max_connections(50)
-        .min_connections(5)
-        .acquire_timeout(std::time::Duration::from_secs(10))
-        .idle_timeout(std::time::Duration::from_secs(300))
-        .max_lifetime(std::time::Duration::from_secs(1800))
+        .max_connections(20)
+        .min_connections(2)
+        .acquire_timeout(std::time::Duration::from_secs(5))
+        .idle_timeout(std::time::Duration::from_secs(180))
+        .max_lifetime(std::time::Duration::from_secs(900))
         .connect(database_url)
         .await?;
 
@@ -352,7 +352,7 @@ async fn seed_demo_data(pool: &PgPool) -> SaasResult<()> {
         for i in 0..daily_count {
             let (provider_id, model_id) = models_for_usage[(rng_seed as usize) % models_for_usage.len()];
             rng_seed = rng_seed.wrapping_mul(6364136223846793005).wrapping_add(1);
-            let hour = (rng_seed as i32 % 24);
+            let hour = rng_seed as i32 % 24;
             rng_seed = rng_seed.wrapping_mul(6364136223846793005).wrapping_add(1);
             let ts = (day + chrono::Duration::hours(hour as i64) + chrono::Duration::minutes(i as i64)).to_rfc3339();
             let input = (500 + (rng_seed % 8000)) as i32;

crates/zclaw-saas/src/main.rs

@@ -1,6 +1,7 @@
 //! ZCLAW SaaS 服务入口
 
 use axum::extract::State;
+use socket2::{Domain, Protocol, Socket, TcpKeepalive, Type};
 use tower_http::timeout::TimeoutLayer;
 use tracing::info;
 use zclaw_saas::{config::SaaSConfig, db::init_db, state::AppState};
@@ -57,11 +58,30 @@ async fn main() -> anyhow::Result<()> {
 
     let app = build_router(state).await;
 
-    let listener = tokio::net::TcpListener::bind(format!("{}:{}", config.server.host, config.server.port))
-        .await?;
+    // 使用 socket2 创建 TCP listener，启用 keepalive 防止 CLOSE_WAIT 累积
+    let bind_addr: std::net::SocketAddr = format!("{}:{}", config.server.host, config.server.port).parse()?;
+    let domain = if bind_addr.is_ipv6() { Domain::IPV6 } else { Domain::IPV4 };
+    let socket = Socket::new(domain, Type::STREAM, Some(Protocol::TCP))?;
+    socket.set_reuse_address(true)?;
+    socket.set_nonblocking(true)?;
+
+    let keepalive = TcpKeepalive::new()
+        .with_time(std::time::Duration::from_secs(60))
+        .with_interval(std::time::Duration::from_secs(10));
+    #[cfg(target_os = "linux")]
+    let keepalive = keepalive.with_retries(3);
+    socket.set_tcp_keepalive(&keepalive)?;
+    info!("TCP keepalive enabled: 60s idle, 10s interval");
+
+    socket.bind(&bind_addr.into())?;
+    socket.listen(128)?;
+    let std_listener: std::net::TcpListener = socket.into();
+    let listener = tokio::net::TcpListener::from_std(std_listener)?;
     info!("SaaS server listening on {}:{}", config.server.host, config.server.port);
 
-    axum::serve(listener, app.into_make_service_with_connect_info::<std::net::SocketAddr>()).await?;
+    axum::serve(listener, app.into_make_service_with_connect_info::<std::net::SocketAddr>())
+        .with_graceful_shutdown(shutdown_signal())
+        .await?;
     Ok(())
 }
 
@@ -161,8 +181,16 @@ async fn build_router(state: AppState) -> axum::Router {
     axum::Router::new()
         .merge(public_routes)
         .merge(protected_routes)
-        .layer(TimeoutLayer::new(std::time::Duration::from_secs(30)))
+        .layer(TimeoutLayer::new(std::time::Duration::from_secs(15)))
         .layer(TraceLayer::new_for_http())
         .layer(cors)
         .with_state(state)
 }
+
+/// 监听 Ctrl+C 信号，触发 graceful shutdown
+async fn shutdown_signal() {
+    tokio::signal::ctrl_c()
+        .await
+        .expect("Failed to install Ctrl+C handler");
+    info!("Received shutdown signal, draining connections...");
+}

crates/zclaw-saas/src/relay/handlers.rs

@@ -209,7 +209,7 @@ pub async fn chat_completions(
                 .header("Cache-Control", "no-cache")
                 .header("Connection", "keep-alive")
                 .body(body)
-                .unwrap();
+                .expect("SSE response builder with valid status/headers cannot fail");
             Ok(response)
         }
         Err(e) => {

crates/zclaw-saas/src/relay/service.rs

@@ -6,7 +6,6 @@ use tokio::sync::Mutex;
 use crate::error::{SaasError, SaasResult};
 use crate::models::RelayTaskRow;
 use super::types::*;
-use futures::StreamExt;
 
 /// 判断 HTTP 状态码是否为可重试的瞬态错误 (5xx + 429)
 fn is_retryable_status(status: u16) -> bool {

crates/zclaw-saas/src/telemetry/service.rs

@@ -121,6 +121,7 @@ pub async fn get_model_stats(
     }
 
     let where_sql = where_clauses.join(" AND ");
+    let _ = param_idx; // used in loop above, suppress unused-assignment warning
 
     let sql = format!(
         "SELECT