- V4 迁移: psks 表 (version, secret, description, is_active) - PskService: 启动导入 PAR_MEDIABOT_PSK → v1, verify 遍历所有活跃 PSK - HmacAuthInterceptor: PSK 签名优先验签,精简为 Bearer/PSK 双路径 - AdminController: GET/POST /psks + toggle 启禁 - AuthController: register/recover 改用 PskService 验证 - docker-compose.yml 新增 PAR_MEDIABOT_PSK 环境变量 mediabot 端只需: X-Signature = HMAC(PSK, 'email:ts')