refactor: root-package imports (svc/runtime/interfaces) and fix PYTHONPATH

- Rename platform/ to svc/ to avoid shadowing stdlib platform.
- Replace from oclaw.* with from svc/runtime/interfaces; update -m CLI paths.
- tests/conftest: prepend repo root to sys.path (no parent-folder package name).
- CI: paths and offline_eval script under repo root.
- Ops scripts: PYTHONPATH must be repo root for python -m runtime.* (fixes gateway/WhatsApp sidecar startup).
- Fix default oclaw.json path in tabular/file attachment limits; stabilize attachment test config.

Co-authored-by: Cursor <cursoragent@cursor.com>

svc/config/passwords.py

@@ -0,0 +1,25 @@
+"""访问密码解析（环境变量 + 数据库）；Streamlit secrets 在认证模块中处理。"""
+
+from __future__ import annotations
+
+import os
+
+from svc.persistence.sqlite_store import SqliteStore
+
+_DEFAULT_BOOTSTRAP_PASSWORD = "admin123"
+
+
+def load_expected_password(store: SqliteStore, *, extra_candidate: str | None = None) -> str | None:
+    pwd = (os.getenv("AIA_ASSISTANT_PASSWORD") or "").strip()
+    if not pwd:
+        pwd = (os.getenv("OPS_ASSISTANT_PASSWORD") or "").strip()
+    if not pwd and extra_candidate:
+        pwd = extra_candidate.strip()
+    if not pwd:
+        pwd = (store.get_secret("auth_password") or "").strip()
+    if not pwd:
+        pwd = _DEFAULT_BOOTSTRAP_PASSWORD
+    return pwd if pwd else None
+
+
+__all__ = ["load_expected_password"]