feat(log): 设备级 client_id 追踪，X-Client-Id 头校验后绑定请求级与访问日志

- 与 request_id 同一 UUID 白名单校验，非法/缺失丢弃不自生成
- CORS Allow-Headers 增加 X-Client-Id

Co-authored-by: Cursor <cursoragent@cursor.com>

application.go

@@ -588,6 +588,8 @@ func (that *Application) handler(w http.ResponseWriter, req *http.Request) {
 	if requestId == "" {
 		requestId = shortID(6)
 	}
+	// 设备级追踪：前端持久 UUID 经 X-Client-Id 传入（同一校验口径），合法才绑 client_id
+	clientId := normalizeRequestId(req.Header.Get("X-Client-Id"))
 	sid := sessionId
 	if len(sid) > 12 {
 		sid = sid[:12]
@@ -596,6 +598,9 @@ func (that *Application) handler(w http.ResponseWriter, req *http.Request) {
 	// 服务端接收时间（ms），与 View() 写出的 X-Server-Sent-Ms 组成四时间点时钟校准
 	w.Header().Set("X-Server-Received-Ms", strconv.FormatInt(nowUnixTime.UnixMilli(), 10))
 	reqLog := that.Log.WithFields("sid", sid, "request_id", requestId)
+	if clientId != "" {
+		reqLog = that.Log.WithFields("sid", sid, "request_id", requestId, "client_id", clientId)
+	}
 	dbCopy := that.Db
 	dbCopy.Log = reqLog
 
@@ -624,6 +629,9 @@ func (that *Application) handler(w http.ResponseWriter, req *http.Request) {
 				Str("request_id", requestId).
 				Float64("cost_ms", ObjToFloat64(time.Now().UnixNano()-nowUnixTime.UnixNano())/1000000.00).
 				Float64("size_kb", ObjToFloat64(context.DataSize)/1000.00)
+			if clientId != "" {
+				evt = evt.Str("client_id", clientId)
+			}
 			if ipChain != "" && ipChain != ip {
 				evt = evt.Str("ip_chain", ipChain)
 			}
@@ -749,7 +757,7 @@ func (that *Application) crossDomain(context *Context, sessionId string) {
 		header.Set("Access-Control-Allow-Credentials", "true")
 		// credentials 模式下浏览器不认 "*"，必须显式列出可读响应头
 		header.Set("Access-Control-Expose-Headers", "X-Request-Id,X-Server-Received-Ms,X-Server-Sent-Ms")
-		header.Set("Access-Control-Allow-Headers", "X-Requested-With,Content-Type,Access-Token,Authorization,Cookie,Set-Cookie,X-Request-Id")
+		header.Set("Access-Control-Allow-Headers", "X-Requested-With,Content-Type,Access-Token,Authorization,Cookie,Set-Cookie,X-Request-Id,X-Client-Id")
 
 		if sessionId != "" {
 			//跨域允许需要设置cookie的允许跨域https才有效果
@@ -797,7 +805,7 @@ func (that *Application) crossDomain(context *Context, sessionId string) {
 	header.Set("Access-Control-Allow-Credentials", "true")
 	// credentials 模式下浏览器不认 "*"，必须显式列出可读响应头
 	header.Set("Access-Control-Expose-Headers", "X-Request-Id,X-Server-Received-Ms,X-Server-Sent-Ms")
-	header.Set("Access-Control-Allow-Headers", "X-Requested-With,Content-Type,Access-Token,Authorization,Cookie,Set-Cookie,X-Request-Id")
+	header.Set("Access-Control-Allow-Headers", "X-Requested-With,Content-Type,Access-Token,Authorization,Cookie,Set-Cookie,X-Request-Id,X-Client-Id")
 
 	if sessionId != "" {
 		//跨域允许需要设置cookie的允许跨域https才有效果