fix(honeypot): 蜜罐封禁与 enable_auto_ban 解耦 + 泄露扫描后缀匹配

- autoban: 新增 RecordHoneypot 独立通道（不受 enabled 约束）+ 独立阈值/时长；
  IsBanned 不再因 enable_auto_ban=false 而忽略已有封禁
- honeypot: 新增 honeypotSuffixes 后缀匹配，覆盖 /backup.zip、/db.sql、/id_rsa.pem
- 新增配置 honeypot_threshold / honeypot_ban_minutes
- 补测试：autoban/honeypot_test.go、route 侧禁用自动封禁仍封禁

internal/security/honeypot/honeypot.go

@@ -51,7 +51,21 @@ var honeypotFragments = []string{
 	"/wp-config", "/xmlrpc.php", "/wordpress", "/phpmyadmin", "/cgi-bin/",
 	"/.git/", "/.env", "/.aws/", "/.ssh/", "/actuator/", "/swagger",
 	"/druid/", "/solr/", "/nacos/", "/vuln", "/shell?", "/cmd?",
-	"/.bak", "/.old", "/.orig", "/.save", "/.swp", "/.zip", "/.tar.gz", "/.sql",
+	"/.bak", "/.old", "/.orig", "/.save", "/.swp",
+}
+
+// honeypotSuffixes 是按「路径结尾」匹配的敏感文件后缀。
+//
+// 为什么单独列：备份/配置类泄露扫描（/backup.zip、/db.sql、/site.tar.gz、/x.bak）
+// 的文件名主体是随机的，只有后缀稳定。上一版用子串 "/.zip" 匹配，
+// 结果 /backup.zip 命中不了（前面是 "k" 不是 "/"），而 /www.zip、/1.sql 全部漏网。
+// 结尾匹配既精确又不会误伤业务路由（业务 URL 空间里不存在这些后缀），
+// 且 forbiddenPrefixes 仍会先剔除业务前缀。
+var honeypotSuffixes = []string{
+	".zip", ".tar", ".tar.gz", ".tgz", ".gz", ".rar", ".7z", ".bz2",
+	".sql", ".sql.gz", ".dump", ".bak", ".old", ".orig", ".save",
+	".swp", ".env", ".env.bak", ".env.local",
+	".pem", ".key", ".p12", ".pfx", ".jks", ".kdbx", ".ovpn",
 }
 
 // forbiddenPrefixes 是业务路由前缀：即便有人往诱饵表里塞了这些前缀，
@@ -161,6 +175,13 @@ func (h *Honeypot) Match(rawPath string) bool {
 			return true
 		}
 	}
+	// 后缀匹配：备份/配置/密钥类泄露扫描（/backup.zip、/db.sql、/id_rsa.pem）。
+	base := path.Base(p)
+	for _, s := range honeypotSuffixes {
+		if strings.HasSuffix(base, s) {
+			return true
+		}
+	}
 	return false
 }