安全加固：LLM 会话按 (bot,peer) 隔离+历史上限50条，LLM 入队按 (bot,from_node) 限流(60s内5条)，瓦片磁盘缓存单源配额(3000文件/300MB 按mtime淘汰)，签到墙读接口限速+全站每日1000条封顶，敏感数据落盘 AES-256-GCM 加密(MESH_SECRET_KEY, 兼容明文迁移)，admin 改密需验证当前密码+pwd_version 会话撤销，后端 v1.5.0

internal/bot/bot_pki_resolver.go

@@ -4,6 +4,7 @@ import (
 	"encoding/base64"
 	"strings"
 
+	"meshtastic_mqtt_server/internal/secrets"
 	storepkg "meshtastic_mqtt_server/internal/store"
 )
 
@@ -23,7 +24,7 @@ func NewPKIKeyResolver(s *storepkg.Store) func(toNodeNum, fromNodeNum uint32) ([
 		if privateKeyB64 == "" {
 			return nil, nil, false
 		}
-		privateKey, err := base64.StdEncoding.DecodeString(privateKeyB64)
+		privateKey, err := base64.StdEncoding.DecodeString(secrets.Decrypt(privateKeyB64))
 		if err != nil || len(privateKey) != 32 {
 			return nil, nil, false
 		}

internal/bot/bot_service.go

@@ -17,6 +17,7 @@ import (
 
 	storepkg "meshtastic_mqtt_server/internal/store"
 	"meshtastic_mqtt_server/internal/mqtpp"
+	"meshtastic_mqtt_server/internal/secrets"
 )
 
 const botMaxTextBytes = 200
@@ -116,6 +117,7 @@ func (s *Service) buildPKIAck(bot *storepkg.BotNodeRecord, toNum, ackPacketID, r
 	if privateKeyB64 == "" {
 		return nil, fmt.Errorf("bot has no private key")
 	}
+	privateKeyB64 = secrets.Decrypt(privateKeyB64)
 	privateKey, err := base64.StdEncoding.DecodeString(privateKeyB64)
 	if err != nil {
 		return nil, err
@@ -312,6 +314,7 @@ func (s *Service) sendPKIDirect(bot *storepkg.BotNodeRecord, fromNodeNum, toNode
 	if privateKeyB64 == "" {
 		return nil, fmt.Errorf("bot has no private key, regenerate keys first")
 	}
+	privateKeyB64 = secrets.Decrypt(privateKeyB64)
 	privateKey, err := base64.StdEncoding.DecodeString(privateKeyB64)
 	if err != nil {
 		return nil, fmt.Errorf("invalid bot private key: %w", err)