feat: SSH 改纯密码认证（paramiko，禁用密钥/agent 不弹授权框，密码放 .env）+ 部署配置全迁 .env（config.py 不再内置 STF/SSH/Tailscale 值，.env.example 补全 11 项）

web_server.py

@@ -38,10 +38,11 @@ from core.models import db, init_db, User, DeviceGroup, TaskJob, CustomAction
 from core.apk_manager import ApkManager
 from core.adb_helper import (screenshot, list_installed_apps, adb_connect_light,
                              adb_connect, _ADB_LOCK, _adb)
-from core import uiauto_helper, tailscale_client, stf_device_mgmt
+from core import uiauto_helper, tailscale_client, stf_device_mgmt, ssh_client
 from core.tailscale_client import TailscaleError
 from core.stf_device_mgmt import StfDevError
-from config import ADB_PATH, STF_SSH_TARGET, STF_DOCKER_CONTAINER
+from core.ssh_client import SSHError
+from config import ADB_PATH, STF_DOCKER_CONTAINER
 from tasks import list_task_types, get_task_class
 
 _log = get_logger("web")
@@ -1111,22 +1112,17 @@ def api_stf_restart():
     if running:
         return jsonify({"ok": False,
                         "error": f"有 {len(running)} 台设备正在运行任务，请先停止再维护"}), 409
-    ssh_cmd = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
-               "-o", "StrictHostKeyChecking=no", STF_SSH_TARGET,
-               f"docker restart {STF_DOCKER_CONTAINER} && "
-               f"docker ps --filter name={STF_DOCKER_CONTAINER} --format '{{{{.Names}}}}: {{{{.Status}}}}'"]
     try:
-        r = subprocess.run(ssh_cmd, capture_output=True, timeout=60)
-    except subprocess.TimeoutExpired:
-        return jsonify({"ok": False, "error": "SSH 执行超时（60s）"}), 408
-    except FileNotFoundError:
-        return jsonify({"ok": False, "error": "本机未安装 ssh，无法远程操作"}), 500
-    out = (r.stdout or b"").decode("utf-8", errors="replace")
-    err = (r.stderr or b"").decode("utf-8", errors="replace")
-    if r.returncode != 0:
+        code, out, err = ssh_client.run(
+            f"docker restart {STF_DOCKER_CONTAINER} && "
+            f"docker ps --filter name={STF_DOCKER_CONTAINER} --format '{{{{.Names}}}}: {{{{.Status}}}}'",
+            timeout=60)
+    except SSHError as e:
+        return jsonify({"ok": False, "error": str(e)}), 502
+    if code != 0:
         _log.error(f"STF 容器重启失败: {err or out}")
         return jsonify({"ok": False,
-                        "error": f"SSH 执行失败：{err or out}（请确认本机可免密 SSH 到 {STF_SSH_TARGET}，且容器名 {STF_DOCKER_CONTAINER} 正确）"}), 502
+                        "error": f"SSH 执行失败：{err or out}（请确认 SSH 配置（STF_SSH_TARGET / STF_SSH_PASSWORD）且容器名 {STF_DOCKER_CONTAINER} 正确）"}), 502
     # 轮询 STF API 确认恢复（最长 30s）
     alive = False
     for _ in range(30):