fix(deploy): 使用 shlex.quote 防止 curl URL 命令注入

deploy.py

@@ -23,6 +23,7 @@ Purpose: 统一部署所有服务到生产服务器，替代原有的多个 shel
 import io
 import os
 import re
+import shlex
 import sys
 import time
 import subprocess
@@ -525,8 +526,9 @@ def verify_deploy():
 
     for url, label in endpoints:
         null_device = 'NUL' if sys.platform == 'win32' else '/dev/null'
+        safe_url = shlex.quote(url)
         ok, stdout, _ = run_command(
-            f'curl -k -s -o {null_device} -w "HTTP %{{http_code}}" {url}',
+            f'curl -k -s -o {null_device} -w "HTTP %{{http_code}}" {safe_url}',
             timeout=30
         )
         if ok and stdout: