feat: self-connection blocking API support (token-device internal endpoint, jti)

http/router/api.go

@@ -73,6 +73,12 @@ func ApiInit(g *gin.Engine) {
 		frg.POST("/audit/file", au.AuditFile)
 	}
 
+	{
+		in := &api.Internal{}
+		// 仅供hbbs容器内调用：token -> device_id（自连拦截用）
+		frg.GET("/internal/token-device", in.TokenDevice)
+	}
+
 	frg.Use(middleware.RustAuth())
 	{
 		u := &api.User{}