fix(HEL-494): 网站市场客户端改为纯中枢 Facade，并迁移 iFinD 凭据到中枢

生产 gateway 不再读取 Tushare token 或实例化 TushareProvider/TushareClient；问财凭据经带鉴权的中枢接口加密入库，避免发版后 iFinD 未配置。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/test_api.py

@@ -61,6 +61,18 @@ class ApiContractTests(unittest.TestCase):
         self.hub.stop()
         self.tmp.cleanup()
 
+    def _post(self, path: str, body: dict, token: str | None = None) -> tuple[int, dict]:
+        headers = {"Content-Type": "application/json"}
+        if token is not None:
+            headers["X-Datahub-Token"] = token
+        raw = json.dumps(body).encode("utf-8")
+        req = Request(self.base + path, data=raw, headers=headers, method="POST")
+        try:
+            with urlopen(req, timeout=5) as resp:
+                return resp.status, json.loads(resp.read().decode())
+        except HTTPError as exc:
+            return exc.code, json.loads(exc.read().decode())
+
     def _get(self, path: str, token: str | None = None) -> tuple[int, dict]:
         headers = {}
         if token is not None:
@@ -145,6 +157,28 @@ class ApiContractTests(unittest.TestCase):
         self.assertNotIn("tushare-secret-token-xyz", blob)
         self.assertNotIn(self.token, blob)
 
+    def test_ifind_credentials_require_token_and_update_adapter(self) -> None:
+        status, body = self._post(
+            "/v1/credentials/ifind",
+            {"ifind_refresh_token": "refresh-secret", "ifind_access_token": "access-secret"},
+            token=None,
+        )
+        self.assertEqual(status, 401)
+        self.assertEqual(body["error"]["code"], "UNAUTHORIZED")
+        status, body = self._post(
+            "/v1/credentials/ifind",
+            {"ifind_refresh_token": "refresh-secret", "ifind_access_token": "access-secret"},
+            token=self.token,
+        )
+        self.assertEqual(status, 200, body)
+        self.assertTrue(body["data"]["configured"])
+        self.assertTrue(body["data"]["access_ready"])
+        self.assertTrue(self.hub.ifind.configured)
+        self.assertEqual(self.hub.auth.load_credential("ifind_refresh_token"), "refresh-secret")
+        blob = json.dumps(body)
+        self.assertNotIn("refresh-secret", blob)
+        self.assertNotIn("access-secret", blob)
+
 
 if __name__ == "__main__":
     unittest.main()