交易所 API 改为仅服务器配置：前端去掉密钥、新机示例为空，并防止坏钥反复请求触发 Gate 封 IP。

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_api_credentials_lib.py

@@ -0,0 +1,36 @@
+import unittest
+
+from lib.exchange.api_credentials_lib import (
+    credentials_configured,
+    is_exchange_auth_error,
+    normalize_api_credential,
+)
+
+
+class TestNormalizeApiCredential(unittest.TestCase):
+    def test_empty_and_placeholder(self):
+        self.assertEqual(normalize_api_credential(""), "")
+        self.assertEqual(normalize_api_credential(None), "")
+        self.assertEqual(normalize_api_credential("  "), "")
+        self.assertEqual(normalize_api_credential("REPLACE_WITH_GATE_API_KEY"), "")
+        self.assertEqual(normalize_api_credential("CHANGE_TO_LONG_RANDOM_SECRET"), "")
+        self.assertEqual(normalize_api_credential("你的密钥"), "")
+
+    def test_real_key_kept(self):
+        self.assertEqual(normalize_api_credential(" real-key-value "), "real-key-value")
+        self.assertTrue(credentials_configured("abc", "def"))
+        self.assertFalse(credentials_configured("REPLACE_WITH_X", "secret"))
+
+
+class TestAuthErrorDetect(unittest.TestCase):
+    def test_binance_invalid_key(self):
+        class AuthenticationError(Exception):
+            pass
+
+        self.assertTrue(is_exchange_auth_error(AuthenticationError('binance {"code":-2008,"msg":"Invalid Api-Key ID."}')))
+        self.assertTrue(is_exchange_auth_error(Exception("gate INVALID_KEY")))
+        self.assertFalse(is_exchange_auth_error(Exception("rate limit exceeded")))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_instance_display_env_settings.py

@@ -125,7 +125,10 @@ class TestEnvSchema(unittest.TestCase):
         self.assertTrue(by_key["OKX_SHOW_PERP_FUNDS"].get("hot_reload"))
         self.assertNotIn("OKX_OPTIONS_API_KEY", by_key)
         self.assertNotIn("OKX_SUB_ACCOUNT_NAME", by_key)
-        self.assertEqual(by_key["OKX_API_KEY"]["note"], "账户 API(永续+期权共用)")
+        self.assertNotIn("OKX_API_KEY", by_key)
+        self.assertNotIn("OKX_API_SECRET", by_key)
+        self.assertNotIn("OKX_API_PASSPHRASE", by_key)
+        self.assertIn("LIVE_TRADING_ENABLED", by_key)
 
         groups_v = [{"title": "t", "fields": [by_key["TRADE_DIRECTION"]]}]
         clean, errors = validate_env_updates(groups_v, {"TRADE_DIRECTION": "long_only"})