feat(server-check): 增加防火墙异常时的远端自动修复功能

- 检测到防火墙未启用或状态异常时，触发远端修复脚本
- 执行修复后重新检查防火墙状态与开放端口
- 支持 firewalld 和 iptables 类型防火墙的状态识别
- 自动更新检查结果并记录修复过程日志
- 提升服务自检对安全配置的自动化处理能力

辅助工具/脚本工具/服务自检/PRD/服务自检需求文档.md

@@ -238,5 +238,11 @@
     
     例如：当前判断目标服务器的NTP服务存在异常，那么调用issue_handler脚本中的fix_ntp_config函数，脚本执行：./issue_handler.sh --action fix_ntp_config
 
+    防火墙修复：
+        1、目标服务器未开启防火墙时，判断为异常，并执行修复脚本；
+        2、目标服务器开启防火墙时，存在多种判断：
+            - 目标服务器是会议预定系统，那么需检测22、443、1883和8306是否开启，未开启就是异常，需要执行修复脚本；
+            - 目标服务器是运维集控系统，那么需检测22、8443、1883和8306是否开启，未开启就是异常，需要执行修复脚本；
+
 ##### 服务自检报告输出（✅ 已实现）：
     将服务自检的所有操作步骤与结果输出到日志文件中！自检报告需要补充成md格式！
\ No newline at end of file

辅助工具/脚本工具/服务自检/check_server_health.ps1

@@ -1258,6 +1258,73 @@ function Test-ServerResources {
         OpenPorts = $openPorts
         Status = if ($firewallActive) { "已启用" } else { "未启用" }
     }
+
+    # 当防火墙未启用或状态异常时，尝试远端修复（参考 NTP 的上传执行）
+    if (-not $firewallActive -or ($firewallType -eq "unknown")) {
+        Write-Log -Level "WARN" -Message "[FIREWALL] 检测到防火墙未启用或状态异常，准备执行远端修复"
+        try {
+            $serverForRepair = @{ IP = $Server.IP; User = $Server.User; Pass = $Server.Pass; Port = $Server.Port }
+            # 触发远端修复：修复端口开放/防火墙配置
+            Write-Log -Level "INFO" -Message "[FIREWALL] 触发远端修复: ./issue_handler.sh --action fix_port_access --platform auto --non-interactive"
+            $fwRepairRes = Upload_the_repair_script -Server $serverForRepair -Action "fix_port_access" -Platform "auto" -RemoteDir "/home/repair_scripts"
+            if ($fwRepairRes -and $fwRepairRes['Success']) {
+                Write-Log -Level "SUCCESS" -Message "[FIREWALL] 远端修复已执行成功 (fix_port_access)"
+                # 修复后复检防火墙状态与开放端口
+                $firewallStatusCmd = "systemctl is-active firewalld 2>/dev/null || service iptables status 2>/dev/null | head -n 1 || echo 'unknown'"
+                $firewallStatusResult = Invoke-SSHCommand -HostName $Server.IP -User $Server.User -Pass $Server.Pass -Port $Server.Port -Command $firewallStatusCmd
+                $firewallActive = $false; $firewallType = "unknown"
+                if ($firewallStatusResult.Output -match 'active') { $firewallActive = $true; $firewallType = "firewalld" }
+                elseif ($firewallStatusResult.Output -match 'running|OK') { $firewallActive = $true; $firewallType = "iptables" }
+
+                $openPorts = @()
+                if ($firewallActive) {
+                    if ($firewallType -eq "firewalld") {
+                        $portsCmd = "firewall-cmd --list-ports 2>/dev/null && firewall-cmd --list-services 2>/dev/null"
+                        $portsResult = Invoke-SSHCommand -HostName $Server.IP -User $Server.User -Pass $Server.Pass -Port $Server.Port -Command $portsCmd
+                        if ($portsResult.ExitCode -eq 0 -and $portsResult.Output) {
+                            $openPorts = ($portsResult.Output -split "`n" | Where-Object { $_ -match '\S' }) -join ", "
+                        }
+                    } else {
+                        $portsCmd = "iptables -L INPUT -n 2>/dev/null | grep ACCEPT | grep -oP 'dpt:\d+' | cut -d: -f2 | sort -u | head -n 20"
+                        $portsResult = Invoke-SSHCommand -HostName $Server.IP -User $Server.User -Pass $Server.Pass -Port $Server.Port -Command $portsCmd
+                        if ($portsResult.ExitCode -eq 0 -and $portsResult.Output) {
+                            $openPorts = ($portsResult.Output -split "`n" | Where-Object { $_ -match '^\d+$' }) -join ", "
+                        }
+                    }
+                    Write-Log -Level "INFO" -Message "[FIREWALL] 修复后状态: 已启用 ($firewallType)"
+                    if ($openPorts) { Write-Log -Level "INFO" -Message "[FIREWALL] 修复后开放端口/服务: $openPorts" }
+                    else { Write-Log -Level "WARN" -Message "[FIREWALL] 修复后未检测到明确开放的端口" }
+                } else {
+                    Write-Log -Level "WARN" -Message "[FIREWALL] 修复后仍未启用防火墙"
+                }
+
+                # 更新结果集
+                $results.Firewall = @{
+                    Active = $firewallActive
+                    Type = $firewallType
+                    OpenPorts = $openPorts
+                    Status = if ($firewallActive) { "已启用" } else { "未启用" }
+                }
+            } else {
+                # 安全读取错误信息
+                $errMsg = "未知错误"
+                if ($fwRepairRes -is [hashtable]) {
+                    if ($fwRepairRes.ContainsKey('Error') -and $fwRepairRes['Error']) {
+                        $errMsg = [string]::Join(' ', $fwRepairRes['Error'])
+                    } elseif ($fwRepairRes.ContainsKey('Output') -and $fwRepairRes['Output']) {
+                        $errMsg = [string]::Join(' ', $fwRepairRes['Output'])
+                    } elseif ($fwRepairRes.ContainsKey('Message') -and $fwRepairRes['Message']) {
+                        $errMsg = $fwRepairRes['Message']
+                    }
+                } elseif ($fwRepairRes) {
+                    $errMsg = $fwRepairRes.ToString()
+                }
+                Write-Log -Level "ERROR" -Message "[FIREWALL] 远端修复执行失败: $errMsg"
+            }
+        } catch {
+            Write-Log -Level "ERROR" -Message "[FIREWALL] 调用 Upload_the_repair_script 异常: $($_.Exception.Message)"
+        }
+    }
     
     # 7. 检测系统负载
     Write-Log -Level "INFO" -Message "检测系统负载..."