refactor: 重构并优化项目多项功能

1. 调整CORS中间件挂载位置，重构CORS处理逻辑
2. 重写IP获取逻辑，增加私有网络IP信任校验
3. 优化日志中间件，移除/health接口单独日志逻辑
4. 改进API密钥未配置时的提示信息
5. 重构volcano TTS调用，新增voice参数支持
6. 优化请求体过大错误处理
7. 完善统计服务，修复环形缓冲区遍历逻辑，新增去重错误日志功能

middleware/cors.go

@@ -79,35 +79,45 @@ func matchOrigin(origin string) (string, bool) {
 func CORS(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origin := r.Header.Get("Origin")
-		isPreflight := r.Method == http.MethodOptions
 
-		if origin != "" {
-			allowOrigin, matched := matchOrigin(origin)
-			if matched {
-				w.Header().Set("Access-Control-Allow-Origin", allowOrigin)
-				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-				w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
-				w.Header().Set("Access-Control-Expose-Headers", "X-Request-Id")
-				w.Header().Set("Access-Control-Max-Age", corsMaxAgeHeader)
-				if allowOrigin != "*" {
-					w.Header().Set("Access-Control-Allow-Credentials", "true")
-				}
-				vary := w.Header().Get("Vary")
-				if vary == "" {
-					w.Header().Set("Vary", "Origin")
-				} else if !strings.Contains(vary, "Origin") {
-					w.Header().Set("Vary", vary+", Origin")
-				}
-			} else {
-				log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
-					origin, r.URL.Path, r.Method, GetClientIP(r))
-				if isPreflight {
-					w.WriteHeader(http.StatusForbidden)
-					return
-				}
-			}
+		// 无 Origin 头：非跨域请求，跳过 CORS 处理
+		if origin == "" {
+			next.ServeHTTP(w, r)
+			return
 		}
 
+		// 有 Origin 头时，响应必须携带 Vary: Origin 防止 CDN 缓存污染
+		vary := w.Header().Get("Vary")
+		if vary == "" {
+			w.Header().Set("Vary", "Origin")
+		} else if !strings.Contains(vary, "Origin") {
+			w.Header().Set("Vary", vary+", Origin")
+		}
+
+		isPreflight := r.Method == http.MethodOptions
+
+		allowOrigin, matched := matchOrigin(origin)
+		if !matched {
+			// Origin 不在白名单：拒绝请求（预检和非预检均拒绝），
+			// 防止不匹配的请求穿透到后端浪费 TTS 资源
+			log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
+				origin, r.URL.Path, r.Method, GetClientIP(r))
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
+
+		// Origin 匹配：设置 CORS 响应头
+		w.Header().Set("Access-Control-Allow-Origin", allowOrigin)
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+		w.Header().Set("Access-Control-Expose-Headers", "X-Request-Id")
+		w.Header().Set("Access-Control-Max-Age", corsMaxAgeHeader)
+		if allowOrigin != "*" {
+			w.Header().Set("Access-Control-Allow-Credentials", "true")
+		}
+
+		// 预检请求：直接返回 204，不进入内层中间件链，
+		// 避免消耗速率限制配额和并发槽位
 		if isPreflight {
 			w.WriteHeader(http.StatusNoContent)
 			return