feat(phase1): core/ 基础设施迁移，旧路径改垫片

- core/: database/redis_client/jwt/password/response/exceptions/security/logger/deps/middleware/app
- create_app 迁移到 core/app.py，中间件注册顺序与异常处理器原样保留
- extensions/ utils/ apps/ 旧文件全部改为 re-export 垫片，import 路径保持兼容
- 新增 core 单元测试（jwt/password/response/request 共 12 个）

Co-Authored-By: Claude <noreply@anthropic.com>

tests/unit/core/test_jwt.py

@@ -0,0 +1,29 @@
+"""core/jwt.py 纯函数单元测试（不依赖 Redis/DB）。"""
+
+from core import jwt as core_jwt
+
+
+def test_create_and_parse_token():
+    token = core_jwt.create_token({"userId": 1, "username": "admin"})
+    assert isinstance(token, str)
+    result = core_jwt.parse_payload(token)
+    assert result["code"] == 0
+    assert result["data"]["username"] == "admin"
+
+
+def test_parse_invalid_token():
+    result = core_jwt.parse_payload("not.a.valid.token")
+    assert result["code"] == 1
+
+
+def test_refresh_token():
+    token = core_jwt.create_token({"userId": 1})
+    result = core_jwt.refresh_token(token)
+    assert result["code"] == 0
+    assert result["data"]["access_token"]
+
+
+def test_get_token_expiration():
+    token = core_jwt.create_token({"userId": 1}, timeout=30)
+    exp = core_jwt.get_token_expiration(token)
+    assert exp is not None

tests/unit/core/test_password.py

@@ -0,0 +1,19 @@
+"""core/password.py 单元测试。"""
+
+from core import password
+
+
+def test_encrypt_and_verify():
+    salt = password.generate_salt()
+    hashed = password.encrypt_password("123456", salt)
+    assert len(hashed) == 60
+    assert password.verify_password("123456", salt, hashed)
+    assert not password.verify_password("wrong", salt, hashed)
+
+
+def test_same_password_different_hash():
+    """bcrypt 内置盐随机，相同密码两次加密结果不同。"""
+    salt = password.generate_salt()
+    h1 = password.encrypt_password("pw", salt)
+    h2 = password.encrypt_password("pw", salt)
+    assert h1 != h2

tests/unit/core/test_request.py

@@ -0,0 +1,19 @@
+"""utils/request.py 工具函数单元测试。"""
+
+from utils.request import parse_id_list, like_escape, like_contains
+
+
+def test_parse_id_list():
+    assert parse_id_list("1,2,3") == [1, 2, 3]
+    assert parse_id_list("1,a,3") == [1, 3]
+    assert parse_id_list("") == []
+    assert parse_id_list(None) == []
+
+
+def test_like_escape():
+    assert like_escape("50%") == "50\\%"
+    assert like_escape("a_b") == "a\\_b"
+
+
+def test_like_contains():
+    assert like_contains("张") == "%张%"

tests/unit/core/test_response.py

@@ -0,0 +1,28 @@
+"""core/response.py 响应格式单元测试。"""
+
+import json
+
+from core import response as R
+
+
+def test_ok_shape():
+    resp = R.ok(data={"a": 1})
+    body = json.loads(resp.body)
+    assert body["code"] == 0
+    assert body["ok"] is True
+    assert body["data"] == {"a": 1}
+    assert body["msg"] == "操作成功"
+
+
+def test_ok_extra_kwargs():
+    resp = R.ok(data=[], count=10)
+    body = json.loads(resp.body)
+    assert body["count"] == 10
+
+
+def test_failed_shape():
+    resp = R.failed(msg="错误信息")
+    body = json.loads(resp.body)
+    assert body["code"] == 1
+    assert body["ok"] is False
+    assert body["msg"] == "错误信息"