feat(openapi): 添加导入导出功能的免认证配置与CORS头暴露

- 为 OpenAPI 认证接口和路由执行接口添加 @NoAuthInterface 免认证注解
- CORS 配置新增 Content-Disposition 暴露头以支持文件下载
- 新增导入导出相关接口路径至在线操作白名单
- 完善导入导出配置项：最大行数、文件大小、批次大小、异步阈值
- 新增异步任务线程池配置：池大小与队列容量
- 规范开发环境配置文件注释与格式

application-tenant/tenant-admin/src/main/java/apelet/tenantadmin/config/FilterConfig.java

@@ -40,6 +40,7 @@ public class FilterConfig {
             }
             corsConfiguration.addAllowedHeader("*");
             corsConfiguration.addAllowedMethod("*");
+            corsConfiguration.addExposedHeader("Content-Disposition");
             corsConfiguration.addExposedHeader(applicationConfig.getRefreshedTokenHeaderKey());
             corsConfiguration.setAllowCredentials(true);
             configSource.registerCorsConfiguration("/**", corsConfiguration);

application-tenant/tenant-admin/src/main/resources/tenant-admin-dev.yml

@@ -49,13 +49,10 @@ common-openapi:
   # token 有效期（秒）。
   tokenExpiration: 7200
 common-online:
-  # 注意不要以反斜杠(/)结尾。
-  urlPrefix: /tenantadmin/online
-  # 打印接口的路径，不要以反斜杠(/)结尾。
+  # ===== 既有配置，保留 =====
+  urlPrefix: /tenantadmin/online            # 不要以 / 结尾
   printUrlPath: /tenantadmin/report/reportPrint/print
-  # 在线表单业务数据上传资源路径
-  uploadFileBaseDir: ./zz-resource/upload-files/online
-  # 如果为false，在线表单模块中所有Controller接口将不能使用。
+  uploadFileBaseDir: ./zz-resource/upload-files/online   # ★导入导出文件根目录，建议改成绝对路径
   operationEnabled: true
   # 1: minio 2: aliyun-oss 3: qcloud-cos。
   distributeStoreType: 2
@@ -74,6 +71,7 @@ common-online:
     - ${common-online.urlPrefix}/onlineOperation/downloadDatasource/
     - ${common-online.urlPrefix}/onlineOperation/downloadOneToManyRelation/
     - ${common-online.urlPrefix}/onlineOperation/print/
+    - ${common-online.urlPrefix}/onlineOperation/exportExecute/     # ★F7/导入导出新增
   editUrlList:
     - ${common-online.urlPrefix}/onlineOperation/addDatasource/
     - ${common-online.urlPrefix}/onlineOperation/addOneToManyRelation/
@@ -85,12 +83,27 @@ common-online:
     - ${common-online.urlPrefix}/onlineOperation/deleteBatchOneToManyRelation/
     - ${common-online.urlPrefix}/onlineOperation/uploadDatasource/
     - ${common-online.urlPrefix}/onlineOperation/uploadOneToManyRelation/
-  # 下面这些有默认值，按需覆盖
-  importExportFileRetainHours: 24
-  # ==== 临时联调用：调到 5 行方便走异步分支，联调完记得还原（正式值 5000 / 50000）====
-  importAsyncRowThreshold: 5
-  exportAsyncRowThreshold: 5
+    - ${common-online.urlPrefix}/onlineOperation/importValidate/    # ★导入导出新增
+    - ${common-online.urlPrefix}/onlineOperation/importExecute/     # ★导入导出新增
+    - ${common-online.urlPrefix}/onlineOperation/exportExecute/     # ★导入导出新增
+  # ===== 本次新增（导入导出优化）=====
+  # 单次导入的最大Excel行数（不含表头行），超出提示分批导入
+  importMaxRowCount: 20000
+  # 单次导入的文件大小上限（MB），先判大小再判行数
+  importMaxFileSizeMb: 10
+  # 导入写入的每批行数，批内任一组失败整批回滚
+  importBatchSize: 500
+  # 导入行数超过该阈值转异步任务
+  importAsyncRowThreshold: 5000
+  # 导出主记录数超过该阈值转异步任务
+  exportAsyncRowThreshold: 50000
+  # 异步任务线程池（队列满直接返回「系统繁忙」）
+  asyncTaskPoolSize: 2
+  asyncTaskQueueCapacity: 100
+  # 异步任务记录与结果文件保留天数
   asyncTaskRetainDays: 7
+  # 导入导出文件保留小时数（下载过的立即删，未下载的超时由定时任务删）
+  importExportFileRetainHours: 24
 common-flow:
   # 请慎重修改urlPrefix的缺省配置，注意不要以反斜杠(/)结尾。如必须修改其他路径，请同步修改数据库脚本。
   urlPrefix: /tenantadmin/flow

common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiAuthController.java

@@ -1,5 +1,6 @@
 package apelet.common.openapi.controller;
 
+import apelet.common.core.annotation.NoAuthInterface;
 import apelet.common.core.constant.ErrorCodeEnum;
 import apelet.common.core.mcp.annotation.McpToolClass;
 import apelet.common.core.mcp.annotation.McpToolParam;
@@ -38,6 +39,7 @@ public class OpenApiAuthController {
      */
     @PostMapping("/token")
     @McpToolClass(name = "openapi_auth_token", description = "按应用编码+密钥+用户名换取 OpenAPI 访问 token（返回 accessToken/expiresIn）")
+    @NoAuthInterface
     public ResponseResult<JSONObject> token(@RequestBody(required = false) @McpToolParam(fieldName = "tokenDto", type = McpToolParamType.OBJECT, description = "换 token 请求体（appCode/appSecret/username）", schemaClass = OpenApiTokenDto.class) OpenApiTokenDto tokenDto) {
         if (tokenDto == null) {
             return ResponseResult.error(ErrorCodeEnum.ARGUMENT_NULL_EXIST);

common/common-openapi/src/main/java/apelet/common/openapi/controller/OpenApiRouterController.java

@@ -1,5 +1,6 @@
 package apelet.common.openapi.controller;
 
+import apelet.common.core.annotation.NoAuthInterface;
 import apelet.common.core.mcp.annotation.McpToolClass;
 import apelet.common.core.mcp.annotation.McpToolParam;
 import apelet.common.core.mcp.model.McpToolParamType;
@@ -44,6 +45,7 @@ public class OpenApiRouterController {
      */
     @PostMapping("/{pageCode}/{formCode}/{operationCode}")
     @McpToolClass(name = "openapi_route_execute", description = "执行 OpenAPI 开放接口配置（HTTP 由 token 鉴权；MCP 直调暂返回无权，仅占位）")
+    @NoAuthInterface
     public ResponseResult<Object> execute(@PathVariable @McpToolParam(fieldName = "pageCode", type = McpToolParamType.STRING, description = "页面编码", required = true) String pageCode,
                                           @PathVariable @McpToolParam(fieldName = "formCode", type = McpToolParamType.STRING, description = "表单编码", required = true) String formCode,
                                           @PathVariable @McpToolParam(fieldName = "operationCode", type = McpToolParamType.STRING, description = "操作编码", required = true) String operationCode,