fix: API route security fixes (path traversal, auth, bare except)

- articles.py: Path traversal sanitization
- optimizer_logs.py: Admin auth guard
- platform_config.py: Admin auth guard
- system.py: Path traversal whitelist
- topic_config.py: Admin auth guard
- topics.py: Minor fix

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

platform/backend/app/api/platform_config.py

@@ -5,7 +5,7 @@ from typing import List, Optional
 from ..database import get_db
 from ..models import PlatformConfig
 from ..schemas import PlatformConfigCreate, PlatformConfigUpdate, PlatformConfigResponse
-from .auth import get_current_user
+from .auth import get_current_admin
 
 router = APIRouter(prefix="/api/platform-config", tags=["platform-config"])
 
@@ -14,7 +14,7 @@ router = APIRouter(prefix="/api/platform-config", tags=["platform-config"])
 def list_platforms(
     active_only: bool = True,
     db: Session = Depends(get_db),
-    current_user=Depends(get_current_user)
+    current_user=Depends(get_current_admin)
 ):
     query = db.query(PlatformConfig)
     if active_only:
@@ -26,7 +26,7 @@ def list_platforms(
 def create_platform(
     data: PlatformConfigCreate,
     db: Session = Depends(get_db),
-    current_user=Depends(get_current_user)
+    current_user=Depends(get_current_admin)
 ):
     existing = db.query(PlatformConfig).filter(PlatformConfig.platform == data.platform).first()
     if existing:
@@ -39,7 +39,7 @@ def create_platform(
 
 
 @router.get("/{platform}", response_model=PlatformConfigResponse)
-def get_platform(platform: str, db: Session = Depends(get_db), current_user=Depends(get_current_user)):
+def get_platform(platform: str, db: Session = Depends(get_db), current_user=Depends(get_current_admin)):
     p = db.query(PlatformConfig).filter(PlatformConfig.platform == platform).first()
     if not p:
         raise HTTPException(status_code=404, detail="平台不存在")
@@ -47,7 +47,7 @@ def get_platform(platform: str, db: Session = Depends(get_db), current_user=Depe
 
 
 @router.put("/{platform}", response_model=PlatformConfigResponse)
-def update_platform(platform: str, data: PlatformConfigUpdate, db: Session = Depends(get_db), current_user=Depends(get_current_user)):
+def update_platform(platform: str, data: PlatformConfigUpdate, db: Session = Depends(get_db), current_user=Depends(get_current_admin)):
     p = db.query(PlatformConfig).filter(PlatformConfig.platform == platform).first()
     if not p:
         raise HTTPException(status_code=404, detail="平台不存在")
@@ -59,7 +59,7 @@ def update_platform(platform: str, data: PlatformConfigUpdate, db: Session = Dep
 
 
 @router.delete("/{platform}")
-def delete_platform(platform: str, db: Session = Depends(get_db), current_user=Depends(get_current_user)):
+def delete_platform(platform: str, db: Session = Depends(get_db), current_user=Depends(get_current_admin)):
     p = db.query(PlatformConfig).filter(PlatformConfig.platform == platform).first()
     if not p:
         raise HTTPException(status_code=404, detail="平台不存在")