外部集成（HMAC）
签名规则
sign = HMAC_SHA256(secret, timestamp + nonce + body)请求头：
| Header | 说明 |
|---|---|
| X-Ext-Key | API Key |
| X-Ext-Timestamp | Unix 秒 |
| X-Ext-Nonce | 随机字符串（防重放） |
| X-Ext-Sign | 签名（hex） |
示例
curl -X POST https://your-domain/api/external/device/list -H "X-Ext-Key: xxx" -H "X-Ext-Timestamp: 1730000000" -H "X-Ext-Nonce: abc123" -H "X-Ext-Sign: ..."