feat(apitest): 新增 API 测试环境与安全配置

- 新增 apitest 专用 MySQL 配置与 Docker 编排（docker/apitest-mysql.yml、docker/apitest-mysql/）

- 增加 ApiTestSecurityConfig / ApiTestSecurityProperties 与 ApiTestAuthenticationFilter

- 新增 application-apitest.yml 与相关测试目录（play-admin/src/test/java/com/starry/admin/api/）

- 调整根 pom 与 play-admin/pom 依赖，优化 SpringSecurityConfig 以兼容 apitest

play-admin/src/test/java/com/starry/admin/api/AbstractApiTest.java

@@ -0,0 +1,21 @@
+package com.starry.admin.api;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.MockMvc;
+
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@AutoConfigureMockMvc
+@ActiveProfiles("apitest")
+public abstract class AbstractApiTest {
+
+    protected static final String TENANT_HEADER = "X-Tenant";
+    protected static final String USER_HEADER = "X-Test-User";
+    protected static final String DEFAULT_TENANT = "tenant-apitest";
+    protected static final String DEFAULT_USER = "apitest-user";
+
+    @Autowired
+    protected MockMvc mockMvc;
+}

play-admin/src/test/java/com/starry/admin/api/HealthControllerApiTest.java

@@ -0,0 +1,20 @@
+package com.starry.admin.api;
+
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.Test;
+
+class HealthControllerApiTest extends AbstractApiTest {
+
+    @Test
+    void pingReturnsPong() throws Exception {
+        mockMvc.perform(get("/health/ping")
+                        .header(USER_HEADER, DEFAULT_USER)
+                        .header(TENANT_HEADER, DEFAULT_TENANT))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(200))
+                .andExpect(jsonPath("$.data").value("pong"));
+    }
+}

play-admin/src/test/java/com/starry/admin/api/SysTenantPackageControllerApiTest.java

@@ -0,0 +1,22 @@
+package com.starry.admin.api;
+
+import static org.hamcrest.Matchers.hasItem;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.jupiter.api.Test;
+
+class SysTenantPackageControllerApiTest extends AbstractApiTest {
+
+    @Test
+    void getSimpleListReturnsSeededPackage() throws Exception {
+        mockMvc.perform(get("/platform/package/get-simple-list")
+                        .header(USER_HEADER, DEFAULT_USER)
+                        .header(TENANT_HEADER, DEFAULT_TENANT))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.code").value(200))
+                .andExpect(jsonPath("$.data").isArray())
+                .andExpect(jsonPath("$.data[*].id", hasItem("pkg-basic")));
+    }
+}