```

refactor(core): 重构核心模块结构并更新导入路径

- 将配置相关的设置从 app.core.config 移除
- 将常量定义从 app.core.constants 移除
- 将数据库相关功能从 app.core.database 移除
- 将基础数据库模型从 app.core.db_base 移除
- 将敏感信息掩码功能从 app.core.masking 移除
- 将中间件定义从 app.core.middleware 移除
- 将操作保护功能从 app.core.operation_guard 移除
- 将分页工具从 app.core.pagination 移除
- 将请求上下文管理从 app.core.request_context 移除
- 将调度器功能从 app.core.scheduler 移除
- 将安全认证逻辑从 app.core.security 移除
- 将任务队列相关功能从 app.core.task_queue 移除
- 将时间工具从 app.core.time 移除
- 更新 alembic 配置中的 Base 模型导入路径
- 更新各模块中对重构后组件的引用路径
```

app/core/http/masking.py

@@ -0,0 +1,68 @@
+from typing import Any
+
+from app.core.config import get_settings
+
+
+MASKED_VALUE = "[MASKED]"
+SENSITIVE_RESPONSE_KEYS = frozenset(
+    {
+        "account_number",
+        "api_key",
+        "bank_account",
+        "card_no",
+        "direct_llm_api_key",
+        "email",
+        "feishu_app_secret",
+        "feishu_verification_token",
+        "hermes_api_key",
+        "id_card",
+        "mobile",
+        "openclaw_gateway_token",
+        "password",
+        "payment_account",
+        "phone",
+        "secret",
+        "tenant_access_token",
+        "token",
+    }
+)
+
+
+def mask_configured(value: Any, domain: str | None = None) -> Any:
+    """Mask sensitive response fields when response masking is enabled."""
+
+    settings = get_settings()
+    if not settings.mask_sensitive_responses:
+        return value
+    configured_fields = {item.lower() for item in settings.masked_response_fields}
+    return mask_sensitive(value, domain=domain, configured_fields=configured_fields)
+
+
+def mask_sensitive(
+    value: Any,
+    domain: str | None = None,
+    configured_fields: set[str] | None = None,
+) -> Any:
+    if isinstance(value, dict):
+        masked: dict[str, Any] = {}
+        for key, item in value.items():
+            key_text = str(key)
+            if _should_mask(key_text, domain, configured_fields or set()):
+                masked[key_text] = MASKED_VALUE
+            else:
+                masked[key_text] = mask_sensitive(item, domain, configured_fields)
+        return masked
+    if isinstance(value, list):
+        return [mask_sensitive(item, domain, configured_fields) for item in value]
+    if isinstance(value, tuple):
+        return [mask_sensitive(item, domain, configured_fields) for item in value]
+    return value
+
+
+def _should_mask(key: str, domain: str | None, configured_fields: set[str]) -> bool:
+    field = key.lower()
+    if field in SENSITIVE_RESPONSE_KEYS or field in configured_fields:
+        return True
+    if f"*.{field}" in configured_fields:
+        return True
+    return bool(domain and f"{domain.lower()}.{field}" in configured_fields)