P1: 功能修复

- v2 三处 self.format_file_size -> format_file_size(3 个端点不再必崩)
- requirements 加 bcrypt、移除未使用的 aiohttp
- verify_user 改用 bcrypt.checkpw(DB basic 登录恢复);SHA256 回退改自描述 PBKDF2,去掉明文接受
- config.py token 模式只在缺失时生成(不再每次 update 失效)
- docker/npm/go/apt/yum 镜像补 cache_enabled/cache_ttl 初始化(不再必 500)
- docker 镜像兼容 upstream_url 配置键
- 定时同步链路: 回调委托 sync_starter 并注入 _sync_manager;cron 逗号列表修复;星期偏移修复
- v2 同步方法与 v1 签名兼容;MirrorSyncManager 补 get_source_status/stop_all_tasks_for_source

core/scheduler.py

@@ -98,7 +98,10 @@ class ScheduledTask:
 
         # 处理列表: "1,2,3"
         if ',' in part:
-            return self._parse_cron_part(part.replace(',', ' '), min_val, max_val)
+            result = []
+            for sub in part.split(','):
+                result.extend(self._parse_cron_part(sub.strip(), min_val, max_val))
+            return result
 
         # 处理范围: "1-5"
         if '-' in part:
@@ -144,12 +147,15 @@ class ScheduledTask:
         if not self.cron_parts:
             return False
 
+        # cron 约定: 0=周日...6=周六; datetime.weekday(): 0=周一...6=周日
+        cron_weekday = (dt.weekday() + 1) % 7
+
         return (
             dt.minute in self.cron_parts['minute'] and
             dt.hour in self.cron_parts['hour'] and
             dt.day in self.cron_parts['day'] and
             dt.month in self.cron_parts['month'] and
-            dt.weekday() in self.cron_parts['weekday']
+            cron_weekday in self.cron_parts['weekday']
         )
 
     def get_next_run_time(self) -> Optional[datetime]: