refactor(mytoolkit): 移除历史兼容，统一分层配置键，补全 Config 单测

- config.Config 仅支持 ~/.mytoolkit/config.json 分层键
- 删除旧 env.json/module-config.json 迁移逻辑与 flat-key 别名
- ssh/bib/image 命令改用 connections.* / paths.* / secrets.api_keys.*
- 单测覆盖分层读写、嵌套删除、export、resolve_key、权限

tests/test_config.py

@@ -1,10 +1,4 @@
-"""Tests for mytoolkit.config.Config (get/set/remove/export + legacy migration).
-
-MYTOOLKIT_HOME is pointed at a temp dir by conftest.py before imports, so
-every Config() instance here operates on throwaway files.
-"""
-
-import json
+"""Tests for mytoolkit.config.Config (hierarchical get/set/remove/export)."""
 
 import pytest
 
@@ -17,21 +11,44 @@ def fresh_home(tmp_path, monkeypatch):
     """Give each test its own empty MYTOOLKIT_HOME."""
     home = tmp_path / "home"
     monkeypatch.setattr(config_mod, "CONFIG_PATH", home / "config.json")
-    monkeypatch.setattr(config_mod, "_LEGACY_ENV_PATH", home / "env.json")
-    monkeypatch.setattr(config_mod, "_LEGACY_MODULE_PATH", home / "module-config.json")
     return home
 
 
 def test_set_get_remove_roundtrip(fresh_home):
     c = Config()
-    assert c.get("apikey_ark") is None
-    c.set("apikey_ark", "sk-test")
-    assert c.get("apikey_ark") == "sk-test"
+    assert c.get("secrets.api_keys.ark") is None
+    c.set("secrets.api_keys.ark", "sk-test")
+    assert c.get("secrets.api_keys.ark") == "sk-test"
     # Persisted: a fresh instance sees the same value.
-    assert Config().get("apikey_ark") == "sk-test"
-    assert c.remove("apikey_ark") is True
-    assert c.remove("apikey_ark") is False
-    assert c.get("apikey_ark") is None
+    assert Config().get("secrets.api_keys.ark") == "sk-test"
+    assert c.remove("secrets.api_keys.ark") is True
+    assert c.remove("secrets.api_keys.ark") is False
+    assert c.get("secrets.api_keys.ark") is None
+
+
+def test_nested_set_creates_intermediate_dicts(fresh_home):
+    c = Config()
+    c.set("connections.ssh.workstation.host", "10.0.0.5")
+    assert c.get("connections.ssh.workstation.host") == "10.0.0.5"
+    assert c.get("connections.ssh") == {"workstation": {"host": "10.0.0.5"}}
+
+
+def test_remove_nested_cleans_leaf_but_keeps_parents(fresh_home):
+    c = Config()
+    c.set("a.b.c", 1)
+    assert c.remove("a.b.c") is True
+    assert c.get("a.b.c") is None
+    assert c.get("a.b") == {}
+
+
+def test_get_all_returns_flat_dot_paths(fresh_home):
+    c = Config()
+    c.set("secrets.api_keys.ark", "sk-ark")
+    c.set("paths.cv", "/tmp/cv")
+    assert c.get_all() == {
+        "secrets.api_keys.ark": "sk-ark",
+        "paths.cv": "/tmp/cv",
+    }
 
 
 def test_get_all_returns_copy(fresh_home):
@@ -42,10 +59,23 @@ def test_get_all_returns_copy(fresh_home):
     assert c.get("k") == "v"
 
 
-def test_export_prefix(fresh_home):
+def test_export_prefix_and_underscore_replacement(fresh_home):
     c = Config()
-    c.set("volc_appid", "123")
-    assert c.export() == {"MYCLI_VOLC_APPID": "123"}
+    c.set("secrets.api_keys.ark", "sk-test")
+    assert c.export() == {"MYCLI_SECRETS_API_KEYS_ARK": "sk-test"}
+
+
+def test_resolve_key_env_overrides_config(fresh_home, monkeypatch):
+    c = Config()
+    c.set("secrets.api_keys.ark", "sk-config")
+    monkeypatch.setenv("ARK_API_KEY", "sk-env")
+    assert c.resolve_key("secrets.api_keys.ark", env_var="ARK_API_KEY") == "sk-env"
+
+
+def test_resolve_key_falls_back_to_config(fresh_home):
+    c = Config()
+    c.set("secrets.api_keys.ark", "sk-config")
+    assert c.resolve_key("secrets.api_keys.ark", env_var="MISSING_VAR") == "sk-config"
 
 
 def test_corrupt_config_falls_back_to_empty(fresh_home):
@@ -55,28 +85,7 @@ def test_corrupt_config_falls_back_to_empty(fresh_home):
     assert c.get_all() == {}
 
 
-def test_legacy_env_json_migrated(fresh_home):
-    fresh_home.mkdir(parents=True)
-    (fresh_home / "env.json").write_text(
-        json.dumps({"vars": {"apikey_ark": "sk-old", "path_study": "/tmp/x"}})
-    )
+def test_file_permissions_are_restrictive(fresh_home):
     c = Config()
-    assert c.get("apikey_ark") == "sk-old"
-    assert c.get("path_study") == "/tmp/x"
-    # env.json renamed out of the way so migration does not re-run.
-    assert not (fresh_home / "env.json").exists()
-    assert (fresh_home / "env.json.migrated").exists()
-
-
-def test_legacy_env_merges_without_clobbering_existing_keys(fresh_home):
-    fresh_home.mkdir(parents=True)
-    (fresh_home / "config.json").write_text(
-        json.dumps({"keys": {"apikey_ark": "sk-new"}})
-    )
-    (fresh_home / "env.json").write_text(
-        json.dumps({"vars": {"apikey_ark": "sk-old", "extra": "e"}})
-    )
-    c = Config()
-    # Unknown legacy vars are merged in; known keys keep the existing mytoolkit value.
-    assert c.get("extra") == "e"
-    assert c.get("apikey_ark") == "sk-new"
+    c.set("k", "v")
+    assert (fresh_home / "config.json").stat().st_mode & 0o777 == 0o600