重构: 后端 df-ai/commands 拆分+df-nodes/workflow 改造+P0 bug 修复

- df-ai: context 历史中毒三档自愈 sanitize_messages(AC3)+anthropic_compat tool_use_id None 跳过(AC1/AC2)+删 router/stream 死码
- df-core: events 加 select_type+decisions 多选审批契约(F-260615-01)
- df-execute: shell run_command 工具复用(F-260615-05)
- df-nodes: human_node 多选校验+2 端到端测(F-01)+取消跳 set_failed(B-03b-R1/R2/R8)
- df-workflow: executor/dag/state cancel 闭环(B-06/07/03a/b)+provider approve options(R-PD-5)
- df-storage: find_path_conflict 抽公共(R-PD-11)+COLS 常量断言
- df-ideas: 删 IdeaPromoter/PromotionPolicy 死码(R-PD-14)
- src-tauri/commands/ai: secret keyring 迁移(FR-S1/R-PD-4)+GeneratingGuard RAII+disarm(B-09/26)+newConversation 软复位(B-10)+stream 心跳/stop select/空回复判错(B-02/04/05/15)+run_command(F-05)+mask audit(AR-3)
- src-tauri/commands/{project,task,workflow,mod,lib,state}: task detail IPC(F-02)+approve decisions+task list 联动(B-29)
- Cargo.lock+Cargo.toml 依赖同步

src-tauri/src/lib.rs

@@ -23,6 +23,12 @@ pub fn run() {
 
             // 初始化全局状态（打开数据库 + 执行迁移）
             let app_state = tauri::async_runtime::block_on(AppState::init(&db_path))?;
+            // FR-S1:启动一次性迁移 DB 明文 api_key → OS keyring(失败保留明文下次重试,非阻断)
+            if let Err(e) = tauri::async_runtime::block_on(
+                commands::ai::secret::migrate_secrets_to_keyring(&app_state.ai_providers),
+            ) {
+                tracing::warn!("[FR-S1] 启动密钥迁移失败(非阻断): {}", e);
+            }
             app.manage(app_state);
             Ok(())
         })
@@ -47,6 +53,7 @@ pub fn run() {
             commands::task::create_task,
             commands::task::update_task,
             commands::task::delete_task,
+            commands::task::get_task_by_id,
             // 灵感
             commands::idea::list_ideas,
             commands::idea::create_idea,