Merge pull request #56 from xmindlab-heicode/feat/agent-endpoint-security-scheme

feat(agent): return A2A endpoint security scheme/profile (#55)

docs/integration/heicode-desktop-client-api.md

@@ -260,7 +260,12 @@ signature = base64( ed25519_sign( device_priv, sha256(canonical) ) )
       "status": "Pending",                        // Pending | running | failed | stopped …
       "runtime_id": "dep-4bb07dc1e376",           // AM 侧运行时 id
       "created_at": "2026-06-04T09:04:15Z",
-      "updated_at": "2026-06-04T09:04:15Z"
+      "updated_at": "2026-06-04T09:04:15Z",
+      "security": {                                // ★ #55 A2A 直连安全元数据
+        "scheme": "http",                          //   http | https
+        "security_profile": "none",                //   none | tls | mtls
+        "secure": false                            //   = security_profile != none
+      }
     }
   ],
   "total": 1
@@ -346,6 +351,8 @@ signature = base64( ed25519_sign( device_priv, sha256(canonical) ) )
 > ⚠️ **连之前先确认 agent 就绪**:新建后 `status=Pending`(还在拉起)。等 `GET /api/heicode/agents/{id}/status` 变 `running`、或 `GET {subdomain}/health` 返 200 再连。**2026-06-04 复测:数秒即 `running`,`/health` 200、`/message/send` 带令牌任务 `completed`,直连已通。**
 >
 > ⚠️ 当前 AM 侧两点(待加固,不影响调通):① **令牌校验尚未真正生效**——无 `X-Agent-Access-Token` 也被放行;客户端仍应规范地每请求都带,等 AM 开启校验即自动生效。② 子域名目前 `http://` 明文,令牌/`api_key` 会明文传输,等 AM 上 HTTPS。
+>
+> 🔒 **传输安全门(#55)**:agent 对象回传 `security`(`scheme` http/https、`security_profile` none/tls/mtls、`secure` 布尔)。客户端据此在生产强制 HTTPS(`HEICODE_AGENT_REQUIRE_SECURE=1`):`secure=false`(当前明文)→ 拒绝直连并提示。AM 上线 HTTPS/mTLS listener 后 `security_profile` 自动变 tls,客户端无需改包。HM 保守口径:无法确证 TLS 即标 `none`。
 
 - **同步**:`POST {subdomain}/message/send`
 - **流式**:`POST {subdomain}/message/stream`(返回 `text/event-stream`)