fix(recon): support FOFA key-only auth in passive recon

[wuchulonly]

Problem

passive -s fofa ... is unavailable for FOFA accounts that only hold a single API key (the norm since FOFA simplified auth in 2023 — "Just need API KEY, no email anymore!", the legacy email&key format stays compatible).

UncoverEngine required both FofaEmail and FofaKey to be non-empty to register the fofa source, so a key-only account could never satisfy it → fofa never appeared in available sources.

Refs #41.

Root cause

pkg/tools/scan/engine/uncover.go:

• NewUncoverEngine: if opts.FofaEmail != "" && opts.FofaKey != ""
• detectSources: {"fofa", e.keys.FofaEmail != "" && e.keys.FofaKey != ""}
• richFofaAgent.Query: if session.Keys.FofaEmail == "" || session.Keys.FofaKey == ""

But the actual FOFA request URL (fofaURL) only ever sends ?key=<key> — the email is never used, so requiring it is purely restrictive.

Fix

• NewUncoverEngine: register fofa when FofaKey is present; email optional. Legacy email:key still accepted.
• Backfill FofaKey after GetKeys() — uncover only populates the pair when the stored credential splits into two email:key segments, so key-only credentials need manual backfill (covers config.yaml, --fofa-key, and FOFA_KEY without an email).
• detectSources / richFofaAgent: gate on FofaKey only.

Verification

• go build -tags full ./... ✅
• go test -tags full ./pkg/tools/scan/engine/ -run 'Fofa|Recon' ✅ (existing + 2 new: key-only, legacy)
• End-to-end with a real key-only FOFA credential: passive -s fofa 'domain="..."' returns real results.

Note

passive/recon is behind the full build tag, so it requires ./build.sh --profile full (or go build -tags full). The default mini profile doesn't compile it in.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

[wuchulonly]

关于 tidy check 失败

这个 tidy 失败是 master 上预存在的问题，不是本 PR 引入的。

证据：master 最新一次 CI（commit 9bfef9f，即本 PR 的 base）的 tidy job 同样失败 ——
https://github.com/chainreactors/aiscan/actions/runs/28047984876 （tidy: failure）。更早还有一次 chore: go mod tidy 提交也仍然挂掉。

为什么本 PR 也红：本 PR 只改了 pkg/tools/scan/engine/uncover.go 和它的测试，没有新增任何 import。fofa 改动不可能影响 go mod tidy 的结果。但因为 CI 里 test/build 等 job 都是 needs: tidy，tidy 一红，其余 check 全部 skipping。

为什么难以本地修复：CI 的 go1.25.7（actions/go-versions 构建，GOTOOLCHAIN=local）解析依赖时会引入 go.yaml.in/yaml/v2，而本地无论用模块化 toolchain 还是官方原生 go1.25.7，解析出的都是 go.yaml.in/yaml/v3/v4 —— 是 CI 环境（构建/GOPROXY）相关的解析差异，本地无法复现。而且 ci.yml 里 go.mod 一旦不一致就 exit 1，连 go.sum 的 diff 都看不到。

建议（需要 maintainer 在 master 上处理）：

1. 在 CI 环境里跑一次 go mod tidy 并把结果提交到 master（用 CI 实际用的那个 Go 构建跑，保证一致）；
2. 或检查 GOPROXY / 是否需要把 go.yaml.in 相关解析对齐；
3. 也可以把 needs: tidy 的强依赖去掉，让 tidy 失败不阻断其它检查。

本 PR 的 fofa 修复本身（fix(recon): support FOFA key-only auth）已本地 go build -tags full + 单测 + 真实 FOFA key 端到端验证通过，等 tidy 这个上游问题解决后即可正常跑完所有 check。