fix: 安全加固 — HMAC_SECRET 启动检查 + 登录锁定 + PSK 窗口配置

- SecurityCheck: 启动时 HMAC_SECRET 为空输出 ERROR 日志
- AccountServiceImpl: Caffeine 缓存实现登录失败计数/锁定
  (par.security.login-max-failures=5, login-lock-minutes=30)
- PskService: pskWindowSeconds 从 application.yml 读取
- AdminController: 清理重复 import

par-api/src/main/java/com/par/api/config/SecurityCheck.java

@@ -0,0 +1,29 @@
+package com.par.api.config;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+
+/**
+ * 启动时安全配置检查
+ */
+@Slf4j
+@Component
+public class SecurityCheck {
+
+    @Value("${hmac.secret:}")
+    private String hmacSecret;
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void checkHmacSecret() {
+        if (hmacSecret == null || hmacSecret.isBlank()) {
+            log.error("============================================");
+            log.error("  HMAC_SECRET is not set!");
+            log.error("  Set HMAC_SECRET environment variable.");
+            log.error("  Without it, Bearer tokens are forgeable.");
+            log.error("============================================");
+        }
+    }
+}

par-api/src/main/java/com/par/api/controller/AdminController.java

@@ -21,8 +21,6 @@ import org.springframework.web.bind.annotation.*;
 import java.time.LocalDateTime;
 import java.util.List;
 import java.util.Map;
-import java.util.Map;
-import java.util.List;
 
 /**
  * 管理员控制器