init: 从 /root/zikai 根目录迁入

把原本散落在 /root/zikai 的 FastAPI 服务整理到 server/ 子目录，
开启独立 git 与 venv。运行时数据（config.yaml / keys / uploads）
按 .gitignore 留在工作目录但不入仓。

app/controllers/__init__.py

@@ -0,0 +1,6 @@
+"""Controller 层：API 路由。"""
+
+from .file_controller import router as file_router
+from .system_controller import router as system_router
+
+__all__ = ["file_router", "system_router"]

app/controllers/file_controller.py

@@ -0,0 +1,72 @@
+"""文件上传 / 列表 / 下载接口。"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
+from fastapi.responses import FileResponse
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..dao.uploaded_file_dao import UploadedFileDAO
+from ..schemas.file import FileListResponse, FileUploadResponse, UploadedFileOut
+from ..services.upload_service import UploadService
+
+router = APIRouter(prefix="/api/files", tags=["files"])
+
+
+def _service(db: Session = Depends(get_db)) -> UploadService:
+    return UploadService(UploadedFileDAO(db))
+
+
+@router.post(
+    "/upload",
+    response_model=FileUploadResponse,
+    summary="上传单个文件（流式，支持大文件）",
+    description=(
+        "multipart/form-data 上传，按 1 MiB 分片流式落盘，内存占用恒定；"
+        "落盘过程中计算 SHA-256 并入库。\n\n"
+        "极大或极慢的传输建议改用 SFTP（详见 README），HTTP 链路受 Apache 代理 300s 超时限制。"
+    ),
+)
+async def upload_file(
+    file: UploadFile = File(..., description="要上传的文件"),
+    service: UploadService = Depends(_service),
+) -> FileUploadResponse:
+    if not file.filename:
+        raise HTTPException(400, "请求缺少 'file' 字段")
+    return service.stream_to_disk(file, source="http", uploaded_by="anonymous")
+
+
+@router.get("", response_model=FileListResponse, summary="列出已上传的文件")
+def list_files(
+    limit: int = 100,
+    offset: int = 0,
+    service: UploadService = Depends(_service),
+) -> FileListResponse:
+    total, items = service.list_files(limit=limit, offset=offset)
+    return FileListResponse(total=total, items=items)
+
+
+@router.get("/{file_id}", response_model=UploadedFileOut, summary="查询单个文件元数据")
+def get_file(file_id: int, service: UploadService = Depends(_service)) -> UploadedFileOut:
+    out = service.get_out(file_id)
+    if out is None:
+        raise HTTPException(404, "文件不存在")
+    return out
+
+
+@router.get("/{file_id}/download", summary="下载文件")
+def download_file(file_id: int, service: UploadService = Depends(_service)) -> FileResponse:
+    out = service.get_out(file_id)
+    if out is None:
+        raise HTTPException(404, "文件不存在")
+    path: Path | None = service.resolve_disk_path(file_id)
+    if path is None or not path.exists():
+        raise HTTPException(410, "文件实体已不在磁盘上")
+    return FileResponse(
+        path=str(path),
+        media_type=out.content_type or "application/octet-stream",
+        filename=out.original_filename,
+    )

app/controllers/system_controller.py

@@ -0,0 +1,39 @@
+"""系统监控接口。"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Request
+from fastapi.responses import HTMLResponse, JSONResponse, Response
+
+from ..schemas.system import SystemStatus
+from ..services.system_service import SystemService
+from ..views.system_status_html import render as render_status_html
+
+router = APIRouter(prefix="/api/system", tags=["system"])
+
+
+def _wants_html(request: Request, fmt: str | None) -> bool:
+    if fmt == "json":
+        return False
+    if fmt == "html":
+        return True
+    accept = request.headers.get("accept", "").lower()
+    return "text/html" in accept and "application/json" not in accept
+
+
+@router.get(
+    "/status",
+    summary="主机资源状态（HTML 或 JSON）",
+    description=(
+        "返回 CPU、内存、磁盘的实时使用情况（数据来源 psutil）。\n\n"
+        "**内容协商**：浏览器（`Accept: text/html`）返回 HTML 页面，API 客户端返回 JSON。"
+        "可用 `?format=html` / `?format=json` 强制指定。"
+    ),
+    response_model=SystemStatus,
+    responses={200: {"content": {"application/json": {}, "text/html": {"schema": {"type": "string"}}}}},
+)
+def get_status(request: Request, format: str | None = None) -> Response:
+    status = SystemService().get_status()
+    if _wants_html(request, format):
+        return HTMLResponse(render_status_html(status))
+    return JSONResponse(status.model_dump(mode="json"))