Audit fixes: LIVE symbols/fills/expiry/pending, security harden, add 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/auth.py

@@ -42,7 +42,11 @@ def _b64url_decode(s: str) -> bytes:
 
 def issue_token(username: str, settings: Settings) -> tuple[str, int]:
     exp = int(time.time()) + int(settings.auth_token_ttl_sec)
-    payload = {"u": username, "exp": exp}
+    payload = {
+        "u": username,
+        "exp": exp,
+        "v": int(settings.auth_token_version),
+    }
     raw = _b64url(json.dumps(payload, separators=(",", ":")).encode("utf-8"))
     sig = hmac.new(
         settings.auth_secret.encode("utf-8"),
@@ -70,6 +74,8 @@ def verify_token(token: str, settings: Settings) -> str:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid token") from e
     if int(payload.get("exp") or 0) < int(time.time()):
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="token expired")
+    if int(payload.get("v") or 0) != int(settings.auth_token_version):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="token revoked")
     username = str(payload.get("u") or "")
     if not username:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid token")