feat: 扩充 shell 命令白名单(含 containerd/ctr/nerdctl)，解除 AI Agent 轮数上限

- 新增 ~50 个 Linux 基础命令(du/top/iostat/sar/curl/tcpdump 等)
- 新增 containerd 系列: ctr (containers/images/tasks/snapshots),
  nerdctl (ps/logs/inspect/stats 等)
- ip 命令补充 maddr/monitor/tunnel/tuntap 只读操作
- _run_agent_loop 改为 while True 循环，max_steps=0 表示不限轮数
- main.py 传入 max_steps=0，AI Agent 持续诊断直到问题解决
- 更新 Agent system prompt 第7条：明确无轮数上限

backend/agent_tools.py

@@ -117,14 +117,24 @@ SHELL_READ_ONLY_COMMANDS: dict[str, set[str] | None] = {
     },
     "journalctl": None,  # 只读，任意参数 (-u, -n, --no-pager, --since 等)
     "crictl": {"ps", "inspect", "logs", "info", "version", "images", "stats"},
+    "ctr": {"containers", "images", "namespaces", "tasks", "snapshots", "info", "version", "plugins", "content", "leases"},
+    "nerdctl": {"ps", "logs", "inspect", "info", "version", "images", "stats", "top", "events", "system", "namespace", "network", "volume"},
     "docker": {"ps", "logs", "inspect", "stats", "version", "info", "images", "top"},
-    "df": None, "free": None, "uptime": None, "uname": None, "hostname": None,
-    "ip": {"addr", "address", "route", "link", "neighbor", "neigh", "rule"},
+    "df": None, "du": None, "free": None, "uptime": None, "uname": None, "hostname": None,
+    "ip": {"addr", "address", "route", "link", "neighbor", "neigh", "rule", "maddr", "monitor", "tunnel", "tuntap"},
     "ss": None, "netstat": None, "lsblk": None, "ls": None, "cat": None,
     "head": None, "tail": None, "wc": None, "grep": None, "egrep": None, "fgrep": None,
-    "ps": None, "mount": None, "lsmod": None, "lscpu": None, "lsof": None,
+    "ps": None, "pstree": None, "mount": None, "lsmod": None, "lscpu": None, "lsof": None,
     "dmesg": None, "ping": None, "nslookup": None, "dig": None, "getent": None,
     "timedatectl": None, "date": None, "stat": None, "file": None, "blkid": None,
+    "top": None, "htop": None, "iostat": None, "vmstat": None, "mpstat": None,
+    "pidstat": None, "sar": None, "nproc": None, "env": None, "which": None,
+    "readlink": None, "realpath": None, "find": None, "sort": None, "uniq": None,
+    "awk": None, "sed": None, "cut": None, "tr": None, "tee": None,
+    "basename": None, "dirname": None, "xargs": None, "bc": None, "expr": None,
+    "curl": None, "wget": None, "traceroute": None, "tracepath": None, "mtr": None,
+    "nc": None, "nmap": None, "telnet": None, "tcpdump": None, "ethtool": None,
+    "lspci": None, "lsusb": None, "dmidecode": None, "sysctl": None, "udevadm": None,
 }
 
 # etcdctl / etcdutl 由 classify_shell_command 中的专用块处理 (两段式命令)