feat: 普通用户可维护应用版本号

tests/test_security.py

@@ -37,8 +37,8 @@ def test_production_rejects_default_security_settings(monkeypatch):
         config.validate_production_security()
 
 
-def test_config_routes_limit_regular_users_to_apps(client, tmp_config):
-    """普通账号只能管理 Apps，不能读取或修改包含密钥的配置。"""
+def test_config_routes_limit_regular_users_to_apps_and_versions(client, tmp_config):
+    """普通账号可管理 Apps 与版本号，不能读取或修改管理员配置。"""
     response = client.post("/api/users", json={
         "username": "builder",
         "password": "builder-password-123",
@@ -55,6 +55,11 @@ def test_config_routes_limit_regular_users_to_apps(client, tmp_config):
 
     assert client.get("/api/config/apps", headers=headers).status_code == 200
     assert client.post("/api/config/apps", json={"name": "普通用户 App"}, headers=headers).status_code == 200
+    assert client.get("/api/config/versions", headers=headers).status_code == 200
+    assert client.put("/api/config/versions", json={
+        "app_ver": "2.196.0", "build_ver": "2.196.0.0",
+    }, headers=headers).status_code == 200
     assert client.get("/api/config", headers=headers).status_code == 403
     assert client.get("/api/config/servers", headers=headers).status_code == 403
+    assert client.put("/api/config/build", json={"max_concurrent_builds": 1}, headers=headers).status_code == 403
     assert client.put("/api/config/upload", json={"mode": "oss"}, headers=headers).status_code == 403