fix: WebConfig HMAC 拦截器排除 GET pages/version 端点公开访问

par-core/src/main/java/com/par/core/config/WebConfig.java

@@ -30,13 +30,15 @@ public class WebConfig implements WebMvcConfigurer {
         registry.addInterceptor(anonymousStatInterceptor)
                 .addPathPatterns("/api/v1/sites/**", "/api/v1/configs/**", "/api/v1/manifest");
 
-        // HMAC 鉴权拦截器：拦截所有写入端点
+        // HMAC 鉴权拦截器：拦截所有写入端点（仅 PUT/POST/DELETE）
         registry.addInterceptor(hmacAuthInterceptor)
                 .addPathPatterns("/api/v1/configs/*/submit", "/api/v1/sites/*/submit",
                         "/api/v1/sites/*/access-result", "/api/v1/sites/*/error-log",
                         "/api/v1/sites/*/pages",            // PUT 页面配置
                         "/api/v1/scripts/*",                // PUT 上传脚本
                         "/api/v1/risk-rules/*",             // POST 提交风险规则
-                        "/api/v1/admin/**", "/api/v1/account/**");
+                        "/api/v1/admin/**", "/api/v1/account/**")
+                .excludePathPatterns(
+                        "/api/v1/sites/*/pages/version");   // GET 版本号公开
     }
 }