Add batch management APIs, API security, rate limiting, and optimizations

- Batch device CRUD: POST /api/devices/batch (create 500), PUT /api/devices/batch (update 500),
  POST /api/devices/batch-delete (delete 100) with WHERE IN bulk queries
- Batch command: POST /api/commands/batch with model_validator mutual exclusion
- API key auth (X-API-Key header, secrets.compare_digest timing-safe)
- Rate limiting via SlowAPIMiddleware (60/min default, 30/min writes)
- Real client IP extraction (X-Forwarded-For / CF-Connecting-IP)
- Global exception handler (no stack trace leaks, passes HTTPException through)
- CORS with auto-disable credentials on wildcard origins
- Schema validation: IMEI pattern, lat/lon ranges, Literal enums, MAC/UUID patterns
- Heartbeats router, per-ID endpoints for locations/attendance/bluetooth
- Input dedup in batch create, result ordering preserved
- Baidu reverse geocoding, Gaode map tiles with WGS84→GCJ02 conversion
- Device detail panel with feature toggles and command controls
- Side panel for location/beacon pages with auto-select active device

via [HAPI](https://hapi.run)

Co-Authored-By: HAPI <noreply@hapi.run>

app/services/device_service.py

@@ -9,7 +9,7 @@ from sqlalchemy import func, select, or_
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.models import Device
-from app.schemas import DeviceCreate, DeviceUpdate
+from app.schemas import DeviceCreate, DeviceUpdate, BatchDeviceCreateItem
 
 
 async def get_devices(
@@ -189,6 +189,103 @@ async def delete_device(db: AsyncSession, device_id: int) -> bool:
     return True
 
 
+async def get_devices_by_ids(db: AsyncSession, device_ids: list[int]) -> list[Device]:
+    """Fetch multiple devices by IDs in a single query."""
+    if not device_ids:
+        return []
+    result = await db.execute(select(Device).where(Device.id.in_(device_ids)))
+    return list(result.scalars().all())
+
+
+async def get_devices_by_imeis(db: AsyncSession, imeis: list[str]) -> list[Device]:
+    """Fetch multiple devices by IMEIs in a single query."""
+    if not imeis:
+        return []
+    result = await db.execute(select(Device).where(Device.imei.in_(imeis)))
+    return list(result.scalars().all())
+
+
+async def batch_create_devices(
+    db: AsyncSession, items: list[BatchDeviceCreateItem]
+) -> list[dict]:
+    """Batch create devices, skipping duplicates. Uses single query to check existing."""
+    # One query to find all existing IMEIs
+    imeis = [item.imei for item in items]
+    existing_devices = await get_devices_by_imeis(db, imeis)
+    existing_imeis = {d.imei for d in existing_devices}
+
+    results: list[dict] = [{} for _ in range(len(items))]  # preserve input order
+    new_device_indices: list[tuple[int, Device]] = []
+    seen_imeis: set[str] = set()
+    for i, item in enumerate(items):
+        if item.imei in existing_imeis:
+            results[i] = {"imei": item.imei, "success": False, "device_id": None, "error": f"IMEI {item.imei} already exists"}
+            continue
+        if item.imei in seen_imeis:
+            results[i] = {"imei": item.imei, "success": False, "device_id": None, "error": "Duplicate IMEI in request"}
+            continue
+        seen_imeis.add(item.imei)
+        device = Device(imei=item.imei, device_type=item.device_type, name=item.name)
+        db.add(device)
+        new_device_indices.append((i, device))
+
+    if new_device_indices:
+        await db.flush()
+        for idx, device in new_device_indices:
+            await db.refresh(device)
+            results[idx] = {"imei": device.imei, "success": True, "device_id": device.id, "error": None}
+
+    return results
+
+
+async def batch_update_devices(
+    db: AsyncSession, device_ids: list[int], update_data: DeviceUpdate
+) -> list[dict]:
+    """Batch update devices with the same settings. Uses single query to fetch all."""
+    devices = await get_devices_by_ids(db, device_ids)
+    found_map = {d.id: d for d in devices}
+    update_fields = update_data.model_dump(exclude_unset=True)
+    now = datetime.now(timezone.utc)
+
+    results = []
+    for device_id in device_ids:
+        device = found_map.get(device_id)
+        if device is None:
+            results.append({"device_id": device_id, "success": False, "error": f"Device {device_id} not found"})
+            continue
+        for field, value in update_fields.items():
+            setattr(device, field, value)
+        device.updated_at = now
+        results.append({"device_id": device_id, "success": True, "error": None})
+
+    if any(r["success"] for r in results):
+        await db.flush()
+
+    return results
+
+
+async def batch_delete_devices(
+    db: AsyncSession, device_ids: list[int]
+) -> list[dict]:
+    """Batch delete devices. Uses single query to fetch all."""
+    devices = await get_devices_by_ids(db, device_ids)
+    found_map = {d.id: d for d in devices}
+
+    results = []
+    for device_id in device_ids:
+        device = found_map.get(device_id)
+        if device is None:
+            results.append({"device_id": device_id, "success": False, "error": f"Device {device_id} not found"})
+            continue
+        await db.delete(device)
+        results.append({"device_id": device_id, "success": True, "error": None})
+
+    if any(r["success"] for r in results):
+        await db.flush()
+
+    return results
+
+
 async def get_device_stats(db: AsyncSession) -> dict:
     """
     获取设备统计信息 / Get device statistics.