fix: security remediation follow-up and OLT button layout improvements

- fix Casdoor JWT verification with correct PythonProject public key
- fix iMC TLS cert validation with custom SSL adapter (skip hostname check for non-DNS CN)
- add iMC CA cert and Casdoor public key to build context
- improve OLT manage page: unify button styles, fix mobile grid spacing, replace el-upload with native input for consistent alignment
- swap NTP sync button for duplicate MAC on mobile

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/core/security.py

@@ -37,7 +37,7 @@ def verify_casdoor_token(token: str) -> dict:
     header = pyjwt.get_unverified_header(token)
     algorithm = header.get("alg")
     if algorithm not in {"RS256", "RS384", "RS512"}:
-        raise ValueError("Unsupported Casdoor token algorithm")
+        raise ValueError(f"Unsupported Casdoor token algorithm: {algorithm}")
 
     return pyjwt.decode(
         token,

backend/app/services/imc_service.py

@@ -39,16 +39,52 @@ class IMCService:
     """iMC REST API 服务封装"""
 
     def __init__(self):
+        import os
+        import tempfile
+        import certifi
+        from requests.adapters import HTTPAdapter
+
         self.base_url = settings.IMC_API_URL.rstrip('/')
         self.username = settings.IMC_API_USERNAME
         self.password = settings.IMC_API_PASSWORD
-        self.verify_ssl = settings.IMC_API_VERIFY_SSL
         self.connect_timeout = settings.IMC_CONNECT_TIMEOUT
         self.read_timeout = settings.IMC_READ_TIMEOUT
         self.session = requests.Session()
         self.realm = "iMC RESTful Web Services"
         self.nonce = None
         self.nc = 1
+        self._ca_bundle_file = None  # temp file for certifi + iMC CA
+
+        if settings.IMC_API_VERIFY_SSL:
+            imc_ca_path = os.path.join(os.path.dirname(__file__), "..", "..", "imc_ca.pem")
+            if os.path.isfile(imc_ca_path):
+                # The iMC self-signed cert uses a non-DNS CN and zero SAN entries,
+                # so hostname matching is impossible.  We still enforce full
+                # certificate-chain verification via a combined CA bundle, then
+                # tell urllib3 to skip its own hostname check.
+                with open(imc_ca_path, "rb") as fh:
+                    imc_pem = fh.read()
+                self._ca_bundle_file = tempfile.NamedTemporaryFile(suffix=".pem", delete=False)
+                with open(certifi.where(), "rb") as fh:
+                    self._ca_bundle_file.write(fh.read())
+                self._ca_bundle_file.write(b"\n")
+                self._ca_bundle_file.write(imc_pem)
+                self._ca_bundle_file.flush()
+
+                _ca_bundle = self._ca_bundle_file.name
+
+                class _IMCAdapter(HTTPAdapter):
+                    def cert_verify(self, conn, url, verify, cert):
+                        super().cert_verify(conn, url, verify=_ca_bundle, cert=cert)
+                        conn.assert_hostname = False
+
+                self.session.mount("https://", _IMCAdapter())
+                self.verify_ssl = True
+                logger.info("iMC TLS verification enabled (hostname check relaxed)")
+            else:
+                self.verify_ssl = True
+        else:
+            self.verify_ssl = False
 
     # ── Digest 认证 ──────────────────────────────────────────────────────────