feat: add admin crawl, cleanup, delete, logs endpoints with scheduler and tests

- Add POST /admin/crawl with TaskLock-based reentrancy guard
- Add POST /admin/cleanup (tmp files older than 24h) with CrawlLog
- Add POST /admin/delete with date range and 'DELETE' confirm token
- Add GET /admin/logs (paginated CrawlLog + DataDeleteJob viewer)
- Add app/services/cleaner.py (cleanup_tmp, delete_papers_by_date_range)
- Add app/services/scheduler.py (APScheduler daily crawl/cleanup jobs)
- Wire scheduler startup/shutdown hooks in app/main.py
- Add admin nav link in base.html and APP_HOST security warning
- Add apscheduler>=3.10 dependency
- Add tests/test_admin_phase4.py covering the new endpoints

app/main.py

@@ -39,6 +39,13 @@ def create_app() -> FastAPI:
     if settings.ADMIN_TOKEN == "change-me":
         logger.warning("⚠️  ADMIN_TOKEN is the default value 'change-me'. Please change it in .env!")
 
+    if settings.APP_HOST not in ("127.0.0.1", "localhost", "::1"):
+        logger.warning(
+            "⚠️  APP_HOST=%s is not localhost. "
+            "Ensure ADMIN_TOKEN is properly set and access is restricted.",
+            settings.APP_HOST,
+        )
+
     # 静态文件
     app.mount("/static", StaticFiles(directory="app/static"), name="static")
 
@@ -48,6 +55,17 @@ def create_app() -> FastAPI:
     app.include_router(search_router)
     app.include_router(user_router)
 
+    # 调度器（Phase 4）
+    @app.on_event("startup")
+    async def _start_scheduler():
+        from app.services.scheduler import start_scheduler
+        start_scheduler()
+
+    @app.on_event("shutdown")
+    async def _stop_scheduler():
+        from app.services.scheduler import stop_scheduler
+        stop_scheduler()
+
     return app