refactor: 重构配置结构，解耦热词、统一认证、移除 TLS 开关

- 新增 ASRConfig，热词从 doubao 提升为 provider 无关配置
- 移除 SecurityConfig，token 移入 ServerConfig
- 移除 tls_auto 配置项，TLS 始终启用（getUserMedia 要求 HTTPS）
- validate() 改为基于 provider 白名单验证，增加 resource_id 校验
- 简化 main.go：移除 scheme 变量和 HTTP 降级分支
- 更新 config.example.yaml 为新结构并修正环境变量前缀

main.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
+
 	"github.com/imbytecat/voicepaste/internal/asr"
 	"github.com/imbytecat/voicepaste/internal/config"
 	"github.com/imbytecat/voicepaste/internal/paste"
@@ -34,8 +35,8 @@ func main() {
 	initClipboard()
 	lanIPs := mustDetectLANIPs()
 	lanIP := lanIPs[0]
-	tlsResult, scheme := setupTLS(cfg, lanIP)
-	printBanner(cfg, tlsResult, lanIPs, scheme)
+	tlsResult := mustSetupTLS(lanIP)
+	printBanner(cfg, tlsResult, lanIPs)
 	srv := createServer(cfg, lanIP, tlsResult)
 	runWithGracefulShutdown(srv)
 }
@@ -70,59 +71,56 @@ func mustDetectLANIPs() []string {
 	return lanIPs
 }
 
-func setupTLS(cfg config.Config, lanIP string) (*vpTLS.Result, string) {
-	if !cfg.Server.TLSAuto {
-		return nil, "http"
-	}
+func mustSetupTLS(lanIP string) *vpTLS.Result {
 	tlsResult, err := vpTLS.GetTLSConfig(lanIP)
 	if err != nil {
 		slog.Error("TLS setup failed", "error", err)
 		os.Exit(1)
 	}
-	return tlsResult, "https"
+	return tlsResult
 }
 
-func printBanner(cfg config.Config, tlsResult *vpTLS.Result, lanIPs []string, scheme string) {
+func printBanner(cfg config.Config, tlsResult *vpTLS.Result, lanIPs []string) {
 	fmt.Println()
 	fmt.Println("╔══════════════════════════════════════╗")
 	fmt.Println("║          VoicePaste 就绪             ║")
 	fmt.Println("╚══════════════════════════════════════╝")
 	fmt.Println()
-	printAddresses(cfg, tlsResult, lanIPs, scheme)
-	printCertInfo(tlsResult, cfg.Server.TLSAuto)
-	printAuthInfo(cfg.Security.Token)
+	printAddresses(cfg, tlsResult, lanIPs)
+	printCertInfo(tlsResult)
+	printAuthInfo(cfg.Server.Token)
 	fmt.Println()
 	fmt.Println("  在手机浏览器中打开上方地址")
 	fmt.Println("  按 Ctrl+C 停止服务")
 	fmt.Println()
 }
 
-func printAddresses(cfg config.Config, tlsResult *vpTLS.Result, lanIPs []string, scheme string) {
-	token := cfg.Security.Token
+func printAddresses(cfg config.Config, tlsResult *vpTLS.Result, lanIPs []string) {
+	token := cfg.Server.Token
 	if len(lanIPs) == 1 {
-		host := lanIP(tlsResult, lanIPs[0])
-		fmt.Printf("  地址: %s\n", buildURL(scheme, host, cfg.Server.Port, token))
+		host := lanIPHost(tlsResult, lanIPs[0])
+		fmt.Printf("  地址: %s\n", buildURL(host, cfg.Server.Port, token))
 		return
 	}
 	fmt.Println("  地址:")
 	for _, ip := range lanIPs {
-		host := lanIP(tlsResult, ip)
-		fmt.Printf("    - %s\n", buildURL(scheme, host, cfg.Server.Port, token))
+		host := lanIPHost(tlsResult, ip)
+		fmt.Printf("    - %s\n", buildURL(host, cfg.Server.Port, token))
 	}
 }
 
-func lanIP(tlsResult *vpTLS.Result, ip string) string {
+func lanIPHost(tlsResult *vpTLS.Result, ip string) string {
 	if tlsResult != nil {
 		return vpTLS.AnyIPHost(ip)
 	}
 	return ip
 }
 
-func printCertInfo(tlsResult *vpTLS.Result, tlsAuto bool) {
+func printCertInfo(tlsResult *vpTLS.Result) {
 	if tlsResult != nil {
 		fmt.Println("  证书: AnyIP（浏览器信任）")
-	} else if tlsAuto {
-		fmt.Println("  证书: 配置错误（TLS 启用但未获取证书）")
+	} else {
+		fmt.Println("  证书: 获取失败")
 	}
 }
 
@@ -140,22 +138,21 @@ func createServer(cfg config.Config, lanIP string, tlsResult *vpTLS.Result) *ser
 	if tlsResult != nil {
 		tlsConfig = tlsResult.Config
 	}
-	srv := server.New(cfg.Security.Token, lanIP, webContent, tlsConfig)
+	srv := server.New(cfg.Server.Token, lanIP, webContent, tlsConfig)
 	asrFactory := buildASRFactory()
-	wsHandler := ws.NewHandler(cfg.Security.Token, paste.Paste, asrFactory)
+	wsHandler := ws.NewHandler(cfg.Server.Token, paste.Paste, asrFactory)
 	wsHandler.Register(srv.App())
 	return srv
 }
 
 func buildASRFactory() func(chan<- ws.ServerMsg) (func([]byte), func(), error) {
 	return func(resultCh chan<- ws.ServerMsg) (func([]byte), func(), error) {
-		// Read latest config on each new connection
 		cfg := config.Get()
 		asrCfg := asr.Config{
 			AppID:       cfg.Doubao.AppID,
 			AccessToken: cfg.Doubao.AccessToken,
 			ResourceID:  cfg.Doubao.ResourceID,
-			Hotwords:    cfg.Doubao.Hotwords,
+			Hotwords:    cfg.ASR.Hotwords,
 		}
 		client, err := asr.Dial(asrCfg, resultCh)
 		if err != nil {
@@ -186,9 +183,10 @@ func runWithGracefulShutdown(srv *server.Server) {
 		os.Exit(1)
 	}
 }
-func buildURL(scheme, host string, port int, token string) string {
+
+func buildURL(host string, port int, token string) string {
 	if token != "" {
-		return fmt.Sprintf("%s://%s:%d/?token=%s", scheme, host, port, token)
+		return fmt.Sprintf("https://%s:%d/?token=%s", host, port, token)
 	}
-	return fmt.Sprintf("%s://%s:%d/", scheme, host, port)
-}
+	return fmt.Sprintf("https://%s:%d/", host, port)
+}