feat: harden runtime import and frontend verification workflows

internal/provision/runtime_import_service.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 
+	"sub2api-cn-relay-manager/internal/host/sub2api"
 	"sub2api-cn-relay-manager/internal/pack"
 	"sub2api-cn-relay-manager/internal/store/sqlite"
 )
@@ -66,6 +67,12 @@ func (s *RuntimeImportService) Import(ctx context.Context, req RuntimeImportRequ
 	if err != nil {
 		return RuntimeImportResult{}, fmt.Errorf("probe host capabilities: %w", err)
 	}
+
+	// Host readiness preflight check
+	if err := validateHostReadiness(capabilities); err != nil {
+		return RuntimeImportResult{}, fmt.Errorf("host readiness preflight failed: %w", err)
+	}
+
 	capabilityProbeJSON, err := json.Marshal(capabilities)
 	if err != nil {
 		return RuntimeImportResult{}, fmt.Errorf("marshal host capabilities: %w", err)
@@ -302,3 +309,26 @@ func firstNonEmpty(values ...string) string {
 	}
 	return ""
 }
+
+// validateHostReadiness performs preflight checks on host capabilities
+// to ensure the host is ready for import operations.
+func validateHostReadiness(caps sub2api.HostCapabilities) error {
+	var missing []string
+	if !caps.Groups {
+		missing = append(missing, "groups")
+	}
+	if !caps.Channels {
+		missing = append(missing, "channels")
+	}
+	if !caps.Accounts {
+		missing = append(missing, "accounts")
+	}
+	if !caps.AccountTest {
+		missing = append(missing, "account_test")
+	}
+
+	if len(missing) > 0 {
+		return fmt.Errorf("host missing required capabilities: %v", missing)
+	}
+	return nil
+}