修复 API Key ACL 开关的 CI 校验

backend/internal/server/middleware/api_key_auth.go

@@ -90,7 +90,7 @@ func apiKeyAuthWithSubscription(apiKeyService *service.APIKeyService, subscripti
 		// 注意：错误信息故意模糊，避免暴露具体的 IP 限制机制
 		if len(apiKey.IPWhitelist) > 0 || len(apiKey.IPBlacklist) > 0 {
 			clientIP := ip.GetTrustedClientIP(c)
-			if cfg != nil && cfg.Security.TrustForwardedIPForAPIKeyACLLive.Load() {
+			if cfg.TrustForwardedIPForAPIKeyACL() {
 				clientIP = ip.GetClientIP(c)
 			}
 			allowed, _ := ip.CheckIPRestrictionWithCompiledRules(clientIP, apiKey.CompiledIPWhitelist, apiKey.CompiledIPBlacklist)

backend/internal/server/middleware/api_key_auth_test.go

@@ -490,8 +490,7 @@ func TestAPIKeyAuthIPRestrictionCanTrustForwardedClientIPForReverseProxy(t *test
 	}
 
 	cfg := &config.Config{RunMode: config.RunModeSimple}
-	cfg.Security.TrustForwardedIPForAPIKeyACL = true
-	cfg.Security.TrustForwardedIPForAPIKeyACLLive.Store(true)
+	cfg.SetTrustForwardedIPForAPIKeyACL(true)
 	apiKeyService := service.NewAPIKeyService(apiKeyRepo, nil, nil, nil, nil, nil, cfg)
 	router := gin.New()
 	require.NoError(t, router.SetTrustedProxies(nil))