refactor(api): TOML 配置 SSOT、统一错误契约、Auth/事务加固与可观测性 (#33)

配置 SSOT（TOML + .env）
统一错误契约
Auth 与事务边界
Redis / Celery 可靠性:业务 Redis（DB/0）与 Celery broker/backend（DB/1）显式拆分；连接池、sync client
可观测性（OpenTelemetry + LGTM）

api/tests/test_main_app_smoke.py

@@ -0,0 +1,30 @@
+"""Production FastAPI app smoke tests (handlers + middleware + routers)."""
+
+from __future__ import annotations
+
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from app.main import app
+
+
+@pytest.mark.asyncio
+async def test_main_app_health() -> None:
+    transport = ASGITransport(app=app, raise_app_exceptions=False)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        r = await client.get("/health")
+    assert r.status_code == 200
+    assert r.json() == {"status": "ok"}
+
+
+@pytest.mark.asyncio
+async def test_main_app_unauthenticated_conversations_401() -> None:
+    transport = ASGITransport(app=app, raise_app_exceptions=False)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        r = await client.get("/api/conversations")
+    assert r.status_code == 401
+    body = r.json()
+    assert body["error_code"] == "AUTHENTICATION_FAILED"
+    assert "request_id" in body
+    assert r.headers.get("x-request-id")
+    assert r.headers.get("www-authenticate") == "Bearer"