refactor(saas): 架构重构 + 性能优化 — 借鉴 loco-rs 模式

Phase 0: 知识库
- docs/knowledge-base/loco-rs-patterns.md — loco-rs 10 个可借鉴模式研究

Phase 1: 数据层重构
- crates/zclaw-saas/src/models/ — 15 个 FromRow 类型化模型
- Login 3 次查询合并为 1 次 AccountLoginRow 查询
- 所有 service 文件从元组解构迁移到 FromRow 结构体

Phase 2: Worker + Scheduler 系统
- crates/zclaw-saas/src/workers/ — Worker trait + 5 个具体实现
- crates/zclaw-saas/src/scheduler.rs — TOML 声明式调度器
- crates/zclaw-saas/src/tasks/ — CLI 任务系统

Phase 3: 性能修复
- Relay N+1 查询 → 精准 SQL (relay/handlers.rs)
- Config RwLock → AtomicU32 无锁 rate limit (state.rs, middleware.rs)
- SSE std::sync::Mutex → tokio::sync::Mutex (relay/service.rs)
- /auth/refresh 阻塞清理 → Scheduler 定期执行

Phase 4: 多环境配置
- config/saas-{development,production,test}.toml
- ZCLAW_ENV 环境选择 + ZCLAW_SAAS_CONFIG 精确覆盖
- scheduler 配置集成到 TOML

config/saas-development.toml

@@ -0,0 +1,33 @@
+# ZCLAW SaaS 开发环境配置
+# 通过 ZCLAW_ENV=development 或默认使用此配置
+
+[server]
+host = "0.0.0.0"
+port = 8080
+cors_origins = []  # 空 = 开发模式允许所有来源
+
+[database]
+url = "postgres://postgres:123123@localhost:5432/zclaw"
+
+[auth]
+jwt_expiration_hours = 24
+totp_issuer = "ZCLAW SaaS (dev)"
+refresh_token_hours = 168
+
+[relay]
+max_queue_size = 1000
+max_concurrent_per_provider = 5
+batch_window_ms = 50
+retry_delay_ms = 1000
+max_attempts = 3
+
+[rate_limit]
+requests_per_minute = 120
+burst = 20
+
+[scheduler]
+jobs = [
+  { name = "cleanup_rate_limit", interval = "5m", task = "cleanup_rate_limit", run_on_start = false },
+  { name = "cleanup_refresh_tokens", interval = "1h", task = "cleanup_refresh_tokens", run_on_start = false },
+  { name = "cleanup_devices", interval = "24h", task = "cleanup_devices", run_on_start = false },
+]

config/saas-production.toml

@@ -0,0 +1,35 @@
+# ZCLAW SaaS 生产环境配置
+# 通过 ZCLAW_ENV=production 使用此配置
+
+[server]
+host = "0.0.0.0"
+port = 8080
+# 生产环境必须配置 CORS 白名单
+cors_origins = ["https://admin.zclaw.ai", "https://zclaw.ai"]
+
+[database]
+# 生产环境通过 ZCLAW_DATABASE_URL 环境变量覆盖，此处为占位
+url = "postgres://zclaw:CHANGE_ME@db:5432/zclaw"
+
+[auth]
+jwt_expiration_hours = 12
+totp_issuer = "ZCLAW SaaS"
+refresh_token_hours = 168
+
+[relay]
+max_queue_size = 5000
+max_concurrent_per_provider = 10
+batch_window_ms = 50
+retry_delay_ms = 2000
+max_attempts = 3
+
+[rate_limit]
+requests_per_minute = 60
+burst = 10
+
+[scheduler]
+jobs = [
+  { name = "cleanup_rate_limit", interval = "5m", task = "cleanup_rate_limit", run_on_start = false },
+  { name = "cleanup_refresh_tokens", interval = "1h", task = "cleanup_refresh_tokens", run_on_start = false },
+  { name = "cleanup_devices", interval = "24h", task = "cleanup_devices", run_on_start = true },
+]

config/saas-test.toml

@@ -0,0 +1,31 @@
+# ZCLAW SaaS 测试环境配置
+# 通过 ZCLAW_ENV=test 使用此配置
+
+[server]
+host = "127.0.0.1"
+port = 8090
+cors_origins = []
+
+[database]
+# 测试环境使用独立数据库
+url = "postgres://postgres:123123@localhost:5432/zclaw_test"
+
+[auth]
+jwt_expiration_hours = 1
+totp_issuer = "ZCLAW SaaS (test)"
+refresh_token_hours = 24
+
+[relay]
+max_queue_size = 100
+max_concurrent_per_provider = 2
+batch_window_ms = 10
+retry_delay_ms = 100
+max_attempts = 2
+
+[rate_limit]
+requests_per_minute = 200
+burst = 50
+
+[scheduler]
+# 测试环境不启动定时任务
+jobs = []