P1: 架构加固

- 线程池服务器: 连接级读写超时 + 有界队列(BoundedSemaphore),拒绝慢速/洪水连接
- 镜像代理流式转发(64KB 分块 + 4GB 上限),小响应才内存缓存(16MB 上限)
- _serve_cached 支持单段 Range(206);pypi 下载流式化;docker urlopen 补超时

mirrors/pypi.py

@@ -524,16 +524,29 @@ class PyPIMirror:
             req.add_header('User-Agent', 'PyPI-Mirror/1.0')
 
             with urllib.request.urlopen(req, timeout=120) as response:
-                data = response.read()
+                # 流式转发，避免大文件整读入内存；小响应可缓存
+                handler.send_response(200)
+                handler.send_header('Content-Type', 'application/octet-stream')
+                handler.send_header('Content-Length', response.headers.get('Content-Length', ''))
+                handler.end_headers()
 
-            if True:
-                self._set_cache(cache_key, data)
+                total = 0
+                cache_buf = bytearray()
+                max_cache = 16 * 1024 * 1024  # 仅缓存 <=16MB 的文件
+                max_stream = 4 * 1024 * 1024 * 1024
+                while True:
+                    chunk = response.read(64 * 1024)
+                    if not chunk:
+                        break
+                    total += len(chunk)
+                    if total > max_stream:
+                        break
+                    handler.wfile.write(chunk)
+                    if len(cache_buf) < max_cache:
+                        cache_buf.extend(chunk)
 
-            handler.send_response(200)
-            handler.send_header('Content-Type', 'application/octet-stream')
-            handler.send_header('Content-Length', str(len(data)))
-            handler.end_headers()
-            handler.wfile.write(data)
+            if total <= max_cache:
+                self._set_cache(cache_key, bytes(cache_buf))
             return True
 
         except Exception as e: