refactor: 审查修复 — netload 消除重复 /sys 读 + 全项目 gofmt

- netload_linux.go: SampleNetLoad 聚合循环不再对每接口重复
  readIfaceSpeed (snapshot 已汇总 cur.capMbps), 每次采样省 N 次 /sys 读
- gofmt -w: ring.go/ring_engine.go/auth.go/handlers.go/handlers_logs.go/
  handlers_users.go/store.go 结构体字段对齐与注释缩进
- README.md: markdownlint 自动修复 (MD028/MD040)

审查结论: 令牌环本身即互斥协议 — OnToken(收令牌)与 StartRing(发令牌)
在同一节点上由令牌串行化, 不存在需要加锁的竞争; WatchLeader 的读为
良性读, 无需 mutex

internal/cluster/ring.go

@@ -81,9 +81,9 @@ type TopoEntry struct {
 // State is the full cluster picture, replicated on every node:
 // ring membership + pending tasks + active forward topology.
 type State struct {
-	LeaderID   string        `json:"leaderId"`
-	Nodes      []Node        `json:"nodes"`
-	Cycle      int64         `json:"cycle"`
+	LeaderID string `json:"leaderId"`
+	Nodes    []Node `json:"nodes"`
+	Cycle    int64  `json:"cycle"`
 	// RoundDelay rides the token so every node converges on the same ring
 	// cadence (serialized as nanoseconds; the leader refreshes it each round
 	// via tkDelaySince). MUST be serialized — otherwise a token round-trip