refactor(api): TOML 配置 SSOT、统一错误契约、Auth/事务加固与可观测性 (#33)

配置 SSOT（TOML + .env）
统一错误契约
Auth 与事务边界
Redis / Celery 可靠性:业务 Redis（DB/0）与 Celery broker/backend（DB/1）显式拆分；连接池、sync client
可观测性（OpenTelemetry + LGTM）

api/app/core/redis_lock.py

@@ -1,27 +1,9 @@
 """Small Redis lock helpers for background tasks."""
 
-import threading
 import uuid
 from dataclasses import dataclass
 
-import redis
-
-from app.core.config import settings
-
-_redis_lock_client: redis.Redis | None = None
-_redis_lock_init_lock = threading.Lock()
-
-
-def _get_redis_lock_client() -> redis.Redis:
-    """进程内复用单个 Redis 客户端（decode_responses=False，与锁 token 字节一致）。"""
-    global _redis_lock_client
-    if _redis_lock_client is None:
-        with _redis_lock_init_lock:
-            if _redis_lock_client is None:
-                _redis_lock_client = redis.from_url(
-                    settings.redis_url, decode_responses=False
-                )
-    return _redis_lock_client
+from app.core.redis_sync import get_sync_redis
 
 
 @dataclass(frozen=True)
@@ -32,7 +14,7 @@ class RedisLockHandle:
 
 def acquire_redis_lock(key: str, *, ttl_seconds: int) -> RedisLockHandle | None:
     """Acquire a single-owner Redis lock or return None when unavailable."""
-    client = _get_redis_lock_client()
+    client = get_sync_redis(decode_responses=False)
     token = uuid.uuid4().hex.encode("utf-8")
     if not client.set(key, token, nx=True, ex=ttl_seconds):
         return None
@@ -43,7 +25,7 @@ def release_redis_lock(handle: RedisLockHandle | None) -> None:
     """Release the lock only if we still own it."""
     if handle is None:
         return
-    _get_redis_lock_client().eval(
+    get_sync_redis(decode_responses=False).eval(
         """
         if redis.call("GET", KEYS[1]) == ARGV[1] then
             return redis.call("DEL", KEYS[1])