fix: API route security fixes (path traversal, auth, bare except)

- articles.py: Path traversal sanitization
- optimizer_logs.py: Admin auth guard
- platform_config.py: Admin auth guard
- system.py: Path traversal whitelist
- topic_config.py: Admin auth guard
- topics.py: Minor fix

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

platform/backend/app/api/system.py

@@ -17,7 +17,7 @@ from ..core.collector import run_collector, get_collector_status, _running_proce
 import threading
 from ..core.sync import sync_all_topics
 from ..core.scheduler import scheduler
-from .auth import get_current_user, org_filter
+from .auth import get_current_user, get_current_admin, org_filter
 
 PROJECT_ROOT = Path(__file__).resolve().parents[4]
 if os.getenv('PROJECT_ROOT'):
@@ -211,8 +211,14 @@ def review_status():
         return {"status": "idle", "message": "当前无运行中的审查任务"}
     return status
 
+_ALLOWED_LOG_TYPES = {"creator", "collector", "optimizer", "sources", "metrics", "trends", "rank_tracker"}
+
 @router.get("/logs/{log_date}", dependencies=[Depends(get_current_user)])
 def get_logs(log_date: str, log_type: str = "creator"):
+    if log_type not in _ALLOWED_LOG_TYPES:
+        raise HTTPException(status_code=400, detail=f"Invalid log_type: {log_type}")
+    if not re.match(r'^\d{4}-\d{2}-\d{2}$', log_date):
+        raise HTTPException(status_code=400, detail="Invalid log_date format (expected YYYY-MM-DD)")
     log_file = LOGS_DIR / f"{log_type}_{log_date}.log"
     if not log_file.exists():
         raise HTTPException(status_code=404, detail=f"Log file not found: {log_file}")