fix(honeypot): 蜜罐封禁与 enable_auto_ban 解耦 + 泄露扫描后缀匹配

- autoban: 新增 RecordHoneypot 独立通道（不受 enabled 约束）+ 独立阈值/时长；
  IsBanned 不再因 enable_auto_ban=false 而忽略已有封禁
- honeypot: 新增 honeypotSuffixes 后缀匹配，覆盖 /backup.zip、/db.sql、/id_rsa.pem
- 新增配置 honeypot_threshold / honeypot_ban_minutes
- 补测试：autoban/honeypot_test.go、route 侧禁用自动封禁仍封禁

internal/security/honeypot/honeypot.go

@@ -51,7 +51,21 @@ var honeypotFragments = []string{
 	"/wp-config", "/xmlrpc.php", "/wordpress", "/phpmyadmin", "/cgi-bin/",
 	"/.git/", "/.env", "/.aws/", "/.ssh/", "/actuator/", "/swagger",
 	"/druid/", "/solr/", "/nacos/", "/vuln", "/shell?", "/cmd?",
-	"/.bak", "/.old", "/.orig", "/.save", "/.swp", "/.zip", "/.tar.gz", "/.sql",
+	"/.bak", "/.old", "/.orig", "/.save", "/.swp",
+}
+
+// honeypotSuffixes 是按「路径结尾」匹配的敏感文件后缀。
+//
+// 为什么单独列：备份/配置类泄露扫描（/backup.zip、/db.sql、/site.tar.gz、/x.bak）
+// 的文件名主体是随机的，只有后缀稳定。上一版用子串 "/.zip" 匹配，
+// 结果 /backup.zip 命中不了（前面是 "k" 不是 "/"），而 /www.zip、/1.sql 全部漏网。
+// 结尾匹配既精确又不会误伤业务路由（业务 URL 空间里不存在这些后缀），
+// 且 forbiddenPrefixes 仍会先剔除业务前缀。
+var honeypotSuffixes = []string{
+	".zip", ".tar", ".tar.gz", ".tgz", ".gz", ".rar", ".7z", ".bz2",
+	".sql", ".sql.gz", ".dump", ".bak", ".old", ".orig", ".save",
+	".swp", ".env", ".env.bak", ".env.local",
+	".pem", ".key", ".p12", ".pfx", ".jks", ".kdbx", ".ovpn",
 }
 
 // forbiddenPrefixes 是业务路由前缀：即便有人往诱饵表里塞了这些前缀，
@@ -161,6 +175,13 @@ func (h *Honeypot) Match(rawPath string) bool {
 			return true
 		}
 	}
+	// 后缀匹配：备份/配置/密钥类泄露扫描（/backup.zip、/db.sql、/id_rsa.pem）。
+	base := path.Base(p)
+	for _, s := range honeypotSuffixes {
+		if strings.HasSuffix(base, s) {
+			return true
+		}
+	}
 	return false
 }
 

internal/security/honeypot/honeypot_test.go

@@ -16,6 +16,10 @@ func TestMatch(t *testing.T) {
 		"/administrator", "/phpmyadmin", "/actuator/env", "/swagger-ui.html",
 		"/xmlrpc.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",
 		"/wp-admin/../wp-content/x.php",
+		// 后缀匹配：备份/配置/密钥泄露扫描
+		"/backup.zip", "/www.zip", "/site.tar.gz", "/db.sql", "/dump.sql",
+		"/x.bak", "/config.php.bak", "/.env.bak", "/id_rsa.pem", "/private.key",
+		"/server.jks", "/data.ovpn",
 	}
 	for _, p := range hit {
 		if !h.Match(p) {
@@ -29,6 +33,8 @@ func TestMatch(t *testing.T) {
 		"/api/v1/questions", "/static/css/base.css", "/favicon.ico", "/robots.txt",
 		"/about", "/rules", "/sponsor", "/change-logs.html", "/vote/abc",
 		"/explore", "/i18n/en",
+		// 业务 URL 空间里不存在这些后缀
+		"/_/admin.ini", "/api/v1/questions.json", "/user/settings.yaml",
 	}
 	for _, p := range miss {
 		if h.Match(p) {