Audit fixes: LIVE symbols/fills/expiry/pending, security harden, add 更新说明.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_runtime_mode.py

@@ -6,11 +6,8 @@ from app.env_store import live_ready, mask_secret, okx_keys_configured
 def test_mask_secret() -> None:
     assert mask_secret(None) is None
     assert mask_secret("") is None
-    assert mask_secret("abcd") == "****"
-    m = mask_secret("abcdefghij")
-    assert m is not None
-    assert m.endswith("ghij")
-    assert m.startswith("*")
+    assert mask_secret("abcd") == "********"
+    assert mask_secret("abcdefghij") == "********"
 
 
 def test_live_ready_sim(monkeypatch) -> None:

backend/tests/test_symbols.py

@@ -0,0 +1,33 @@
+"""LIVE 合约解析。"""
+
+from app.live.symbols import resolve_perp_inst_id
+
+
+class _FakeDb:
+    def __init__(self, row=None):
+        self._row = row
+
+    def fetchone(self, sql, args=()):
+        return self._row
+
+
+def test_resolve_perp_prefers_group(monkeypatch) -> None:
+    import app.live.symbols as sym
+
+    class S:
+        perp_inst_id = "ETH-USDT-SWAP"
+
+    monkeypatch.setattr(sym, "live_settings", lambda: S())
+    db = _FakeDb({"perp_inst_id": "ETHUSDT"})
+    assert resolve_perp_inst_id(db, group_id="g1") == "ETHUSDT"
+
+
+def test_resolve_perp_fallback_runtime(monkeypatch) -> None:
+    import app.live.symbols as sym
+
+    class S:
+        perp_inst_id = "ETHUSDT"
+
+    monkeypatch.setattr(sym, "live_settings", lambda: S())
+    db = _FakeDb(None)
+    assert resolve_perp_inst_id(db) == "ETHUSDT"