后台·总览与配置
仪表盘与运行配置
管理员得到全站概览，普通用户得到本人用量；以响应里是否有 channels 区分。
sessionimgyoung_session<token>登录下发的会话 cookie；状态变更请求须另以 X-CSRF-Token 头回传会话绑定的 CSRF 令牌。
概览
application/json- response
管理员视图：全站计数、待办、访问与流量估算、热门图与渠道水位
offsite_missing*boolean缺少健康的异地渠道：健康且不在清理中的渠道里没有本机磁盘（local 驱动）以外的，一个健康渠道都没有时同样为 true；此时图片副本与元数据库快照在本机以外都没有可用的一份
images*integerint64storage_bytes*integerint64users*integerint64pending_cleanup*integer待清理裁决数
int64pending_dedup*integer待裁决相似候选数
int64total_accesses*integerint64traffic_estimate_bytes*integer访问数 × 原图字节的粗略估算
int64top_images*array<>channels*array<>curl -X GET 'http://localhost:8721/api/admin/dashboard'{ "offsite_missing": true, "images": 0, "storage_bytes": 0, "users": 0, "pending_cleanup": 0, "pending_dedup": 0, "total_accesses": 0, "traffic_estimate_bytes": 0, "top_images": [ { "id": "string", "url": "string", "file_name": "string", "access_count": 0, "size": 0 } ], "channels": [ { "id": 0, "name": "string", "driver": "string", "healthy": true, "bytes": 0 } ]}全部登录用户可读：界面呈现阈值文案与档位所需的键，以及服务端构建信息；不含任何凭证。
sessionimgyoung_session<token>登录下发的会话 cookie；状态变更请求须另以 X-CSRF-Token 头回传会话绑定的 CSRF 令牌。
运行配置切面
application/json- response
运营配置的只读切面，全部登录用户可读；不含凭证
cold_cleanup_days*integer冷图待清理阈值（天）；0 表示未启用
delete_grace_minutes*integer引用归零到物理删的宽限（分钟）；0 表示立即
process_widths*array<integer>|按需处理允许的宽度档（像素）；空或 null 表示不允许缩放
default_ttl_hours*integer全局默认有效期（小时）；0 表示永不过期
ttl_renew_on_access*boolean公开访问是否顺延带有效期图片的到期时刻
max_upload_mb*integer单图上限（MB）
int64base_url*string对外站点地址；空则按请求域名推导
access_mode*string访问模式
"proxy""redirect"exif_policy*string全局默认 EXIF 档位；S3 PutObject 不适用
"passthrough""strip"encrypt_new_channels*boolean新建渠道未显式指定时的加密默认值；为 true 时继承默认的新渠道不能开 302 直链
build*服务端二进制的构建信息
curl -X GET 'http://localhost:8721/api/admin/config'{ "cold_cleanup_days": 0, "delete_grace_minutes": 0, "process_widths": [ 0 ], "default_ttl_hours": 0, "ttl_renew_on_access": true, "max_upload_mb": 0, "base_url": "string", "access_mode": "proxy", "exif_policy": "passthrough", "encrypt_new_channels": true, "build": { "version": "string", "commit": "string", "built_at": "string" }}请求体为「配置键 → 新值」对象，只动出现的键，保存即热生效；未知键或任一取值非法整体拒绝，不做部分生效。
以时长为单位的配置项（间隔、宽限、有效期、保留期、超时）上限为 100 年的折算值：876000 小时 / 36500 天 /
52560000 分钟 / 3153600000 秒 / 3153600000000 毫秒。
cdn_cloudflare_api_token 传空串表示清除、不传表示不动。仅管理员。
sessionimgyoung_session<token>登录下发的会话 cookie；状态变更请求须另以 X-CSRF-Token 头回传会话绑定的 CSRF 令牌。
X-CSRF-Token*string登录或 GET /api/admin/me 响应里的 csrf_token；缺失或不匹配返回 403
application/json- body
「配置键 → 新值」对象；键与值类型同 Settings，只需给出要改的键
[key: string]?any全量生效配置
application/json- response
bootstrap*引导配置的只读展示；密钥类引导项不出现
settings*运营配置；属性名即配置键，真相在 settings 表，后台修改即热生效
derived*派生状态与内置策略
curl -X PUT 'http://localhost:8721/api/admin/config' \ -H 'X-CSRF-Token: string' \ -H 'Content-Type: application/json' \ -d '{}'{ "bootstrap": { "listen": "string", "data_dir": "string", "trusted_proxies": "string", "metrics_allow": "string" }, "settings": { "max_upload_mb": 0, "max_pixels_mp": 0, "max_concurrent_uploads": 0, "upload_rate_per_min": 0, "base_url": "string", "cdn_cloudflare_zone_id": "string", "cdn_cloudflare_api_token": "string", "allow_empty_referer": true, "exif_policy": "passthrough", "min_success": 0, "access_mode": "proxy", "encrypt_new_channels": true, "health_check_seconds": 0, "backup_interval_hours": 0, "backup_keep": 0, "cleanup_sweep_seconds": 0, "delete_grace_minutes": 0, "default_ttl_hours": 0, "ttl_renew_on_access": true, "activity_flush_seconds": 0, "cold_cleanup_days": 0, "usage_report_seconds": 0, "channel_quota_gb": 0, "dedup_scan_seconds": 0, "dedup_phash_max_distance": 0, "process_widths": [ 0 ], "process_formats": [ "string" ], "process_quality_webp": 0, "process_quality_jpeg": 0, "process_webp_method": 0, "process_workers": 0, "process_timeout_ms": 0, "variants_cache_mb": 0, "idempotency_key_ttl_hours": 0, "alert_webhook_url": "string", "audit_retention_days": 0 }, "derived": { "cdn_purge_enabled": true, "cdn_api_token_set": true, "login_burst": 0, "login_refill_seconds": 0, "reconcile_interval_seconds": 0 }}引导配置只读展示、运营配置当前值（凭证字段抹空）与派生状态；仅管理员。
sessionimgyoung_session<token>登录下发的会话 cookie；状态变更请求须另以 X-CSRF-Token 头回传会话绑定的 CSRF 令牌。
全量生效配置
application/json- response
bootstrap*引导配置的只读展示；密钥类引导项不出现
settings*运营配置；属性名即配置键，真相在 settings 表，后台修改即热生效
derived*派生状态与内置策略
curl -X GET 'http://localhost:8721/api/admin/config/full'{ "bootstrap": { "listen": "string", "data_dir": "string", "trusted_proxies": "string", "metrics_allow": "string" }, "settings": { "max_upload_mb": 0, "max_pixels_mp": 0, "max_concurrent_uploads": 0, "upload_rate_per_min": 0, "base_url": "string", "cdn_cloudflare_zone_id": "string", "cdn_cloudflare_api_token": "string", "allow_empty_referer": true, "exif_policy": "passthrough", "min_success": 0, "access_mode": "proxy", "encrypt_new_channels": true, "health_check_seconds": 0, "backup_interval_hours": 0, "backup_keep": 0, "cleanup_sweep_seconds": 0, "delete_grace_minutes": 0, "default_ttl_hours": 0, "ttl_renew_on_access": true, "activity_flush_seconds": 0, "cold_cleanup_days": 0, "usage_report_seconds": 0, "channel_quota_gb": 0, "dedup_scan_seconds": 0, "dedup_phash_max_distance": 0, "process_widths": [ 0 ], "process_formats": [ "string" ], "process_quality_webp": 0, "process_quality_jpeg": 0, "process_webp_method": 0, "process_workers": 0, "process_timeout_ms": 0, "variants_cache_mb": 0, "idempotency_key_ttl_hours": 0, "alert_webhook_url": "string", "audit_retention_days": 0 }, "derived": { "cdn_purge_enabled": true, "cdn_api_token_set": true, "login_burst": 0, "login_refill_seconds": 0, "reconcile_interval_seconds": 0 }}