feat: 新增管理后台前端项目及安全加固

refactor(saas): 重构认证中间件与限流策略
- 登录限流调整为5次/分钟/IP
- 注册限流调整为3次/小时/IP
- GET请求不计入限流

fix(saas): 修复调度器时间戳处理
- 使用NOW()替代文本时间戳
- 兼容TEXT和TIMESTAMPTZ列类型

feat(saas): 实现环境变量插值
- 支持${ENV_VAR}语法解析
- 数据库密码支持环境变量注入

chore: 新增前端管理界面
- 基于React+Ant Design Pro
- 包含路由守卫/错误边界
- 对接58个API端点

docs: 更新安全加固文档
- 新增密钥管理规范
- 记录P0安全项审计结果
- 补充TLS终止说明

test: 完善配置解析单元测试
- 新增环境变量插值测试用例

desktop/src-tauri/src/intelligence_hooks.rs

@@ -16,29 +16,20 @@ use zclaw_runtime::driver::LlmDriver;
 
 /// Run pre-conversation intelligence hooks
 ///
-/// 1. Build memory context from VikingStorage (FTS5 + TF-IDF + Embedding)
-/// 2. Build identity-enhanced system prompt (SOUL.md + instructions)
+/// Builds identity-enhanced system prompt (SOUL.md + instructions).
 ///
-/// Returns the enhanced system prompt that should be passed to the kernel.
+/// NOTE: Memory context injection is NOT done here — it is handled by
+/// `MemoryMiddleware.before_completion()` in the Kernel's middleware chain.
+/// Previously, both paths injected memories, causing duplicate injection.
 pub async fn pre_conversation_hook(
     agent_id: &str,
-    user_message: &str,
+    _user_message: &str,
     identity_state: &IdentityManagerState,
 ) -> Result<String, String> {
-    // Step 1: Build memory context from Viking storage
-    let memory_context = match build_memory_context(agent_id, user_message).await {
-        Ok(ctx) => ctx,
-        Err(e) => {
-            warn!(
-                "[intelligence_hooks] Failed to build memory context for agent {}: {}",
-                agent_id, e
-            );
-            String::new()
-        }
-    };
-
-    // Step 2: Build identity-enhanced system prompt
-    let enhanced_prompt = match build_identity_prompt(agent_id, &memory_context, identity_state).await {
+    // Build identity-enhanced system prompt (SOUL.md + instructions)
+    // Memory context is injected by MemoryMiddleware in the kernel middleware chain,
+    // not here, to avoid duplicate injection.
+    let enhanced_prompt = match build_identity_prompt(agent_id, "", identity_state).await {
         Ok(prompt) => prompt,
         Err(e) => {
             warn!(
@@ -117,6 +108,10 @@ pub async fn post_conversation_hook(
 }
 
 /// Build memory context by searching VikingStorage for relevant memories
+///
+/// NOTE: Memory injection is now handled by MemoryMiddleware in the Kernel
+/// middleware chain. This function is kept as a utility for ad-hoc queries.
+#[allow(dead_code)]
 async fn build_memory_context(
     agent_id: &str,
     user_message: &str,