feat(FEAT-MO-001): 增加TDX直连配置与客户端

server/libs/config/src/runtime-config.ts

@@ -35,6 +35,12 @@ export interface AiRuntimeConfig {
   timeoutMs: number;
 }
 
+/** API 只允许通过本机 SSH/Tailscale 隧道访问 TDX，禁止把家庭地址暴露给业务请求。 */
+export interface TdxRuntimeConfig {
+  baseUrl: string;
+  timeoutMs: number;
+}
+
 /** RocketMQ 公共寻址配置；实际生产/消费参数由相应进程扩展。 */
 export interface RocketMqRuntimeConfig {
   enabled: boolean;
@@ -54,6 +60,7 @@ interface CommonRuntimeConfig {
 export interface ApiRuntimeConfig extends CommonRuntimeConfig {
   processName: 'api';
   api: Readonly<{ host: string; port: number }>;
+  tdx: Readonly<TdxRuntimeConfig>;
   mysql: MysqlRuntimeConfig;
   ai: AiRuntimeConfig;
 }
@@ -196,6 +203,30 @@ function loadAiConfig(env: EnvironmentSource): AiRuntimeConfig {
   };
 }
 
+function loadTdxConfig(env: EnvironmentSource): TdxRuntimeConfig {
+  const baseUrl = requireText(env, 'TDX_BASE_URL').replace(/\/$/, '');
+  let parsed: URL;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    throw new Error('TDX_BASE_URL 必须为有效 URL');
+  }
+
+  if (parsed.protocol !== 'http:') throw new Error('TDX_BASE_URL 必须使用 http 协议');
+  if (parsed.hostname !== '127.0.0.1') {
+    throw new Error('TDX_BASE_URL 必须指向本机回环地址');
+  }
+  if (parsed.port !== '17710') throw new Error('TDX_BASE_URL 必须使用 17710 端口');
+  if (parsed.pathname !== '' && parsed.pathname !== '/') {
+    throw new Error('TDX_BASE_URL 不得包含额外路径');
+  }
+
+  return {
+    baseUrl: parsed.toString().replace(/\/$/, ''),
+    timeoutMs: parseInteger(env, 'TDX_TIMEOUT_MS', { min: 100, max: 30_000 }),
+  };
+}
+
 function loadRocketMqConfig(env: EnvironmentSource): RocketMqRuntimeConfig {
   const enabled = parseBoolean(env, 'ROCKETMQ_ENABLED');
   const nameServerAddress = optionalText(env, 'ROCKETMQ_NAMESRV_ADDR');
@@ -225,6 +256,7 @@ export function loadApiConfig(env: EnvironmentSource): ApiRuntimeConfig {
       host: requireText(env, 'API_HOST'),
       port: parseInteger(env, 'API_PORT', { min: 1, max: 65_535 }),
     },
+    tdx: loadTdxConfig(env),
     redis: loadRedisConfig(env),
     mysql: loadMysqlConfig(env),
     ai: loadAiConfig(env),