refactor: 审查修复 — netload 消除重复 /sys 读 + 全项目 gofmt

- netload_linux.go: SampleNetLoad 聚合循环不再对每接口重复
  readIfaceSpeed (snapshot 已汇总 cur.capMbps), 每次采样省 N 次 /sys 读
- gofmt -w: ring.go/ring_engine.go/auth.go/handlers.go/handlers_logs.go/
  handlers_users.go/store.go 结构体字段对齐与注释缩进
- README.md: markdownlint 自动修复 (MD028/MD040)

审查结论: 令牌环本身即互斥协议 — OnToken(收令牌)与 StartRing(发令牌)
在同一节点上由令牌串行化, 不存在需要加锁的竞争; WatchLeader 的读为
良性读, 无需 mutex

internal/httpapi/auth.go

@@ -15,7 +15,7 @@ import (
 // Type is one of:
 //   - "user":    a row in the users table, authenticated via Basic + bcrypt.
 //   - "service": the -user/-password flag creds (inter-node cluster traffic
-//                and bootstrap), authenticated via a constant-time compare.
+//     and bootstrap), authenticated via a constant-time compare.
 //   - "key":     an API key, authenticated via Bearer + sha256 lookup.
 //
 // Level is the effective access tier: "read" | "write" | "admin". For users it

internal/httpapi/handlers.go

@@ -38,7 +38,10 @@ func (h *Handler) handleCanvasGet(w http.ResponseWriter, _ *http.Request) {
 		for _, r := range remotes {
 			remoteNames[r.Name] = true
 		}
-		type linkKey struct{ local, remote string; port int }
+		type linkKey struct {
+			local, remote string
+			port          int
+		}
 		linkSeen := make(map[linkKey]bool, len(links))
 		for _, l := range links {
 			linkSeen[linkKey{l.Local, l.Remote, l.RemotePort}] = true
@@ -201,7 +204,10 @@ func (h *Handler) applyCanvas(w http.ResponseWriter, r *http.Request, canvas *ca
 	// Build a set of (local, remote, remotePort) triples from the incoming
 	// canvas links so we can revoke any stale topology entries no longer
 	// present in the canvas (e.g. links that were deleted from the UI).
-	type triple struct{ local, remote string; port int }
+	type triple struct {
+		local, remote string
+		port          int
+	}
 	canvasTriples := make(map[triple]bool, len(canvas.Links))
 	for _, ln := range canvas.Links {
 		canvasTriples[triple{ln.Local, ln.Remote, ln.RemotePort}] = true

internal/httpapi/handlers_logs.go

@@ -60,10 +60,10 @@ func (h *Handler) handleNodeLogs(w http.ResponseWriter, r *http.Request) {
 
 // clusterWorkerLogNode is one node's entry in the export bundle.
 type clusterWorkerLogNode struct {
-	ID    string       `json:"id"`
-	Addr  string       `json:"addr"`
-	OK    bool         `json:"ok"`
-	Error string       `json:"error,omitempty"`
+	ID    string        `json:"id"`
+	Addr  string        `json:"addr"`
+	OK    bool          `json:"ok"`
+	Error string        `json:"error,omitempty"`
 	Logs  *nodeLogsResp `json:"logs,omitempty"`
 }
 

internal/httpapi/handlers_users.go

@@ -162,7 +162,7 @@ func (h *Handler) handleApiKeys(w http.ResponseWriter, r *http.Request) {
 			"userId":    k.UserID,
 			"label":     k.Label,
 			"scope":     k.Scope,
-			"prefix":   k.Prefix,
+			"prefix":    k.Prefix,
 			"createdAt": k.CreatedAt,
 			"key":       plaintext, // shown exactly once
 		})