feat(api): 补齐资源分发服务入口

新增 bat-api 资源 bootstrap/分发 HTTP 服务、RPC release 发现、CDN path 分发、launcher 资源引导兼容、控制面中间件、OpenAPI 和 systemd 模板。

同步 Go 边界文档，明确 Rust bat 是资源生产者和同步运维入口，Go bat-api 是只读 bootstrap/分发服务，试验 Go CLI 产物为 bin/bat-go。

验证：未运行新命令；本轮已按要求停止重复构建/测试。

internal/api/cdn.go

@@ -0,0 +1,87 @@
+package api
+
+import (
+	"fmt"
+	"mime"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func (s *Server) serveCDN(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	idx := s.index()
+	if idx == nil || idx.ResourceRoot == "" {
+		http.Error(w, "resource root not ready", http.StatusServiceUnavailable)
+		return
+	}
+	_, rel, err := SplitCDNPath(r.URL.Path)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	var entry ResourceEntry
+	var hasEntry bool
+	if s.cfg.RequireIndexed {
+		entry, hasEntry = idx.Lookup(rel)
+		if !hasEntry || !entry.Present || !entry.SizeMatch {
+			http.NotFound(w, r)
+			return
+		}
+	}
+
+	abs, err := ResolveUnderRoot(idx.ResourceRoot, rel, true)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	info, err := os.Stat(abs)
+	if err != nil || !info.Mode().IsRegular() {
+		http.NotFound(w, r)
+		return
+	}
+	if s.cfg.RequireIndexed && s.cfg.VerifySize {
+		if hasEntry && entry.Bytes > 0 && uint64(info.Size()) != entry.Bytes {
+			http.Error(w, "size mismatch with release index", http.StatusConflict)
+			return
+		}
+	}
+
+	file, err := os.Open(abs)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	defer file.Close()
+
+	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	w.Header().Set("ETag", cdnETag(entry, hasEntry, info))
+	w.Header().Set("Content-Type", cdnContentType(abs))
+	http.ServeContent(w, r, info.Name(), info.ModTime(), file)
+}
+
+func cdnETag(entry ResourceEntry, hasEntry bool, info os.FileInfo) string {
+	if hasEntry && entry.BLAKE3 != "" {
+		return fmt.Sprintf(`"blake3-%s"`, entry.BLAKE3)
+	}
+	return fmt.Sprintf(`W/"%d-%d"`, info.Size(), info.ModTime().UnixNano())
+}
+
+func cdnContentType(abs string) string {
+	ext := strings.ToLower(filepath.Ext(abs))
+	if ext == ".json" {
+		return "application/json; charset=utf-8"
+	}
+	if ext == ".hash" {
+		return "text/plain; charset=utf-8"
+	}
+	if detected := mime.TypeByExtension(ext); detected != "" {
+		return detected
+	}
+	return "application/octet-stream"
+}