feat(api): 补齐资源分发服务入口

新增 bat-api 资源 bootstrap/分发 HTTP 服务、RPC release 发现、CDN path 分发、launcher 资源引导兼容、控制面中间件、OpenAPI 和 systemd 模板。

同步 Go 边界文档，明确 Rust bat 是资源生产者和同步运维入口，Go bat-api 是只读 bootstrap/分发服务，试验 Go CLI 产物为 bin/bat-go。

验证：未运行新命令；本轮已按要求停止重复构建/测试。

deployments/systemd/bat-api.env.example

@@ -0,0 +1,41 @@
+# Optional overrides for bluearchive-toolkit-bat-api.service.
+#
+# Install as:
+#   sudo install -o root -g root -m 0644 deployments/systemd/bat-api.env.example /etc/bluearchive-toolkit/bat-api.env
+#
+# Production contract:
+#   - bat-api runs in the same server/container environment as Rust bat.
+#   - The current resource_root comes from bat.sock RPC.
+#   - Do not set BAT_API_RESOURCE_ROOT in production; it is only for local
+#     fixtures or emergency read-only diagnostics when RPC is unavailable.
+#   - Publish HTTP through a reverse proxy/TLS if exposed publicly; never expose
+#     bat.sock outside the host.
+#   - Player-facing deployments should set BAT_API_AUTH_TOKEN through a secret
+#     manager or process environment, not in a committed file.
+
+BAT_API_LISTEN=127.0.0.1:18080
+BAT_API_PUBLIC_BASE_URL=http://127.0.0.1:18080
+BAT_API_STATE_DIR=/var/lib/bluearchive-toolkit/daemon-state
+BAT_API_SOCKET=/var/lib/bluearchive-toolkit/daemon-state/bat.sock
+BAT_API_REQUIRE_INDEXED=true
+BAT_API_VERIFY_SIZE=true
+BAT_API_RPC_TIMEOUT=30s
+BAT_API_REFRESH_INTERVAL=1m
+BAT_API_SKIP_ENV_FILE=1
+BAT_API_AUTH_QUERY_PARAM=bat_token
+# BAT_API_AUTH_TOKEN=
+# BAT_API_AUTH_EXEMPT_PATHS=/healthz,/readyz
+BAT_API_TRUST_PROXY_HEADERS=false
+BAT_API_ACCESS_LOG=true
+BAT_API_RATE_LIMIT_RPS=30
+BAT_API_RATE_LIMIT_BURST=120
+BAT_API_MAX_RESOURCE_LIMIT=1000
+
+# Local fixture / emergency only:
+# BAT_API_RESOURCE_ROOT=/var/lib/bluearchive-toolkit/official/current
+
+# Reserved for future API persistence:
+# BAT_API_DATABASE_URL=postgres://bat:@127.0.0.1:5432/bat?sslmode=disable
+# BAT_API_DATABASE_PASSWORD=
+# BAT_API_REDIS_URL=redis://127.0.0.1:6379/0
+# BAT_API_REDIS_PASSWORD=

deployments/systemd/bluearchive-toolkit-bat-api.service

@@ -0,0 +1,43 @@
+[Unit]
+Description=BlueArchiveToolkit bat-api resource bootstrap and distribution
+Documentation=https://github.com/Yuyi-Oak/BlueArchiveToolkit
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=bat
+Group=bat
+WorkingDirectory=/var/lib/bluearchive-toolkit
+Environment=BAT_API_LISTEN=127.0.0.1:18080
+Environment=BAT_API_PUBLIC_BASE_URL=http://127.0.0.1:18080
+Environment=BAT_API_STATE_DIR=/var/lib/bluearchive-toolkit/daemon-state
+Environment=BAT_API_SOCKET=/var/lib/bluearchive-toolkit/daemon-state/bat.sock
+Environment=BAT_API_REQUIRE_INDEXED=true
+Environment=BAT_API_VERIFY_SIZE=true
+Environment=BAT_API_RPC_TIMEOUT=30s
+Environment=BAT_API_REFRESH_INTERVAL=1m
+Environment=BAT_API_SKIP_ENV_FILE=1
+EnvironmentFile=-/etc/bluearchive-toolkit/bat-api.env
+ExecStart=/opt/bluearchive-toolkit/bin/bat-api
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30
+KillSignal=SIGTERM
+StandardOutput=journal
+StandardError=journal
+RuntimeDirectory=bluearchive-toolkit-bat-api
+RuntimeDirectoryMode=0750
+LogsDirectory=bluearchive-toolkit
+LogsDirectoryMode=0750
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadOnlyPaths=/var/lib/bluearchive-toolkit
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target