fix: API route security fixes (path traversal, auth, bare except)

- articles.py: Path traversal sanitization
- optimizer_logs.py: Admin auth guard
- platform_config.py: Admin auth guard
- system.py: Path traversal whitelist
- topic_config.py: Admin auth guard
- topics.py: Minor fix

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

platform/backend/app/api/articles.py

@@ -1,3 +1,4 @@
+import re
 from fastapi import APIRouter, HTTPException, Query, Depends, Body
 from sqlalchemy.orm import Session
 from sqlalchemy import or_
@@ -171,6 +172,8 @@ def get_optimization_report(publish_date: str = None, current_user: User = Depen
     """获取合规优化报告"""
     if not publish_date:
         publish_date = date.today().isoformat()
+    if not re.match(r'^\d{4}-\d{2}-\d{2}$', publish_date):
+        raise HTTPException(status_code=400, detail="Invalid date format (expected YYYY-MM-DD)")
     PROJECT_ROOT = Path('/root/openclaw-workspace/projects/yu-zhi-ran')
     report_path = PROJECT_ROOT / "automation" / "data" / "drafts" / publish_date / "optimization_report.json"
     if not report_path.exists():