fix(app): 修复 AppController 安全与查询问题

- 加强异常处理、类型安全和图片上传校验
- 优化设备相关查询，避免重复访问数据源
- 补充并记录并发测试与审查修复实施计划

water-common/water-common-security/src/main/java/org/dromara/common/security/config/SecurityConfig.java

@@ -38,6 +38,8 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @RequiredArgsConstructor
 public class SecurityConfig implements WebMvcConfigurer {
 
+    private static final String APP_RETRIEVE_PASSWORD_PATH = "/app/v1/retrievePassword";
+
     private final SecurityProperties securityProperties;
     @Value("${sse.path}")
     private String ssePath;
@@ -83,6 +85,7 @@ public class SecurityConfig implements WebMvcConfigurer {
             })).addPathPatterns("/**")
             // 排除不需要拦截的路径
             .excludePathPatterns(securityProperties.getExcludes())
+            .excludePathPatterns(APP_RETRIEVE_PASSWORD_PATH)
             .excludePathPatterns(ssePath);
     }