fix: correct context pruning order and vector alignment

- Prune context BEFORE processing (LSTM forget gate pattern)
  so LLM only sees relevant context, instead of pruning after the fact
- Fix ensureTrained() to recompute all event vectors after retraining
  vectorizer, fixing feature-space mismatch between stored vectors and
  query vector that made relevance scoring effectively random
- Add read lock to knowledge BuildTree() (data race fix)
- Log writeIndex() errors instead of discarding them
- Fix TOCTOU race in document ContextToDoc() dedup
- Fix healthcheck timing (measure elapsed before cleanup)
- Refactor waiter CLI into separate files (state, conn, config, editor,
  history, builtin) for maintainability
- Add CLI plugin API key authentication

internal/plugins/cli/plugin.go

@@ -108,6 +108,26 @@ func (p *Plugin) handleConn(conn net.Conn, s *sdk.PluginSDK) {
 	defer p.wg.Done()
 
 	scanner := bufio.NewScanner(conn)
+
+	apiKey := p.webuiAPIKey()
+	if apiKey != "" {
+		if !scanner.Scan() {
+			return
+		}
+		line := scanner.Text()
+		if !strings.HasPrefix(line, "/auth ") || strings.TrimSpace(line[6:]) != apiKey {
+			writeLine(conn, map[string]interface{}{
+				"type":  "error",
+				"error": "unauthorized",
+			})
+			return
+		}
+		writeLine(conn, map[string]interface{}{
+			"type":    "response",
+			"content": "authenticated",
+		})
+	}
+
 	for scanner.Scan() {
 		line := scanner.Text()
 		if line == "" {
@@ -136,6 +156,19 @@ func (p *Plugin) handleConn(conn net.Conn, s *sdk.PluginSDK) {
 	}
 }
 
+func (p *Plugin) webuiAPIKey() string {
+	if cfgReg == nil {
+		return ""
+	}
+	ps := cfgReg.PluginConfig("webui")
+	if v, _ := ps.Get("api_key"); v != nil {
+		if s, ok := v.(string); ok {
+			return s
+		}
+	}
+	return ""
+}
+
 func (p *Plugin) handleBuiltin(conn net.Conn, line string, s *sdk.PluginSDK) bool {
 	parts := strings.Fields(line)
 	if len(parts) == 0 {

internal/plugins/healthcheck/plugin.go

@@ -456,8 +456,12 @@ func (p *Plugin) testKnowledgeRaw() checkResult {
 	}
 
 	results := hcKnowledge.Search("健康检查测试标记", 3)
+
 	elapsed := time.Since(start)
 
+	// 清理测试条目，避免积累
+	hcKnowledge.Remove(marker)
+
 	if len(results) > 0 {
 		return checkResult{
 			Name:   "knowledge",