feat: 支持 TUSHARE_HTTP_URL 自定义 Tushare Pro 接入地址 (#2048)

* feat: support custom Tushare Pro endpoint via TUSHARE_HTTP_URL

Add TUSHARE_HTTP_URL so the Tushare data source can point at a self-hosted
or third-party compatible endpoint when the official api.tushare.pro is not
reachable. Defaults to the official host when unset, so behavior is
unchanged for existing users.

- data_provider/tushare_fetcher.py: add _resolve_tushare_http_url() helper
  (strip + http(s):// schema validation) and forward the resolved URL into
  _TushareHttpClient, with an info log when a custom endpoint is in use
- .env.example + .github/workflows/00-daily-analysis.yml: document and map
  TUSHARE_HTTP_URL so the new option is wired into the daily job without
  leaving a half-configured state
- tests: cover env parsing (empty/whitespace/http/https/missing schema),
  fetcher fall-through to the official host, and end-to-end POST target
- docs/CHANGELOG.md: flat [Unreleased] entries

Fixes #1985

* refactor: drop unnecessary string-literal type hint in _build_api_client

TushareHttpClient is already defined above TushareFetcher in the module
scope, so a string-literal type hint is not needed for forward reference.
Restore the bare type to match the surrounding code style and reduce the
diff against main.

* docs(tushare): 补 TUSHARE_HTTP_URL 在 full-guide 中英版本的用途/默认行为/workflow 映射说明

按 PR #2048 review 反馈补齐：
- 表格内新增 TUSHARE_HTTP_URL 行（中英文版本同步），明确默认 https://api.tushare.pro 与 http(s):// 前缀要求
- 在 GitHub Actions 段落后补充 TUSHARE_HTTP_URL 的 vars/Secrets 优先级与每日 workflow 0映射说明，与现有非敏感配置（TICKFLOW_PRIORITY）一致
- 完整环境变量列表（中英文版本）补 TUSHARE_HTTP_URL 行，默认值列填 https://api.tushare.pro
- 与代码实现一致：00-daily-analysis.yml 已用 vars.TUSHARE_HTTP_URL || secrets.TUSHARE_HTTP_URL 映射

* docs(tushare): align TUSHARE_HTTP_URL default with runtime and clarify vars/secrets precedence

Per review feedback on PR #2048: the per-repo config contract must stay
consistent across runtime, .env.example, workflow priority, tests and
both zh/en guides. Two fixes applied as a single contract update:

1. Default endpoint alignment. data_provider/tushare_fetcher.py:100,
   .env.example, and tests/test_tushare_fetcher_http_client.py all keep
   the existing official endpoint http://api.tushare.pro, but the zh/en
   full-guide rows had drifted to https://api.tushare.pro. Switching the
   documented default to HTTPS would silently change the runtime contract
   that the feat commit explicitly preserved. Revert both zh and en
   guide rows to http://api.tushare.pro so docs match runtime, .env.example
   and the test assertions.

2. vars/secrets precedence wording. The workflow uses
   'vars.TUSHARE_HTTP_URL || secrets.TUSHARE_HTTP_URL', which means a
   non-empty vars entry always wins and Secrets cannot override it. The
   zh/en notes previously suggested 'Secrets as a tamper fallback' which
   is incorrect under this precedence and can mislead users into thinking
   Secrets has override power. Replace with explicit description of the
   real semantics: vars wins when non-empty; Secrets is only selected
   when the Variable is empty; for a tamper-resistant deployment put the
   value only in Secrets and leave Variables empty.

Both zh and en guides are updated together; the same 6 contract surfaces
(runtime / .env.example / workflow priority / tests / zh guide / en guide)
now describe one consistent contract.

* docs(tushare): remove false Secret-as-tamper-guard claim, document real vars/secrets write-permission model

.env.example

@@ -30,6 +30,11 @@ ANSPIRE_API_KEYS=
 # 数据源配置
 # Tushare Pro Token（可选，从 https://tushare.pro/weborder/#/login?reg=834638 获取）
 TUSHARE_TOKEN=
+# Tushare Pro 自定义接入地址（可选，默认 http://api.tushare.pro）
+# 适用场景：网络无法直达官方接口时指向自建网关或第三方兼容镜像
+# 注意：使用非官方接入地址时，Token 与全部请求内容会经过该第三方服务器，请自行评估数据安全风险
+# 必须以 http:// 或 https:// 开头；留空则保持官方默认地址不变
+# TUSHARE_HTTP_URL=http://api.tushare.pro
 # TickFlow API Key（可选；用于 A 股日 K、实时行情、股票列表/名称与大盘复盘增强，权限不足自动回退）
 # TICKFLOW_API_KEY=
 # TICKFLOW_KLINE_ADJUST=none          # none/forward/backward/forward_additive/backward_additive