feat: add debug log control and optimize error response and cors log

- add DebugLog global variable controlled by BYTEDANCE_TTS_DEBUG env
- enable debug logs for cors, tts upstream, response parsing etc when debug mode is on
- update tts error response to use standardized json error format
- add dashboard and metrics path to cache-control exempt list

middleware/cors.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/volcano-tts/tts-api/common"
 	"github.com/volcano-tts/tts-api/setting"
 )
 
@@ -70,8 +71,10 @@ func CORS(next http.Handler) http.Handler {
 		if !matched {
 			// Origin 不在白名单:拒绝请求(预检和非预检均拒绝),
 			// 防止不匹配的请求穿透到后端浪费 TTS 资源
-			log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
-				origin, r.URL.Path, r.Method, GetClientIP(r))
+			if common.DebugLog {
+				log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
+					origin, r.URL.Path, r.Method, GetClientIP(r))
+			}
 			w.WriteHeader(http.StatusForbidden)
 			return
 		}

middleware/security.go

@@ -12,7 +12,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 		w.Header().Set("X-XSS-Protection", "1; mode=block")
 		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
 
-		if strings.HasPrefix(r.URL.Path, "/v1/") || r.URL.Path == "/health" {
+		if strings.HasPrefix(r.URL.Path, "/v1/") || r.URL.Path == "/health" || r.URL.Path == "/dashboard" || r.URL.Path == "/metrics" {
 			w.Header().Set("Cache-Control", "no-store")
 		}