feat(storage): support ES TLS certificates

[emmmleo]

Summary

• add ES/OpenSearch TLS options for CA file, client certificate, client key, and server certificate verification
• pass TLS settings through huatuo-bamai config, storage driver config, and the Elasticsearch backend
• document the new Storage.ES TLS fields in the sample config and English/Chinese docs
• add coverage for HTTPS CA verification, client certificate loading, and incomplete cert/key config

Testing

• gofmt -w cmd/huatuo-bamai/main.go cmd/huatuo-bamai/config/config.go internal/storage/driver/types.go internal/storage/elasticsearch/client.go internal/storage/elasticsearch/elasticsearch.go internal/storage/elasticsearch/elasticsearch_test.go
• go test ./internal/storage/elasticsearch

[huhong-web]

Code Review for PR #250: feat(storage): support ES TLS certificates

1. Copyright Check

• [PASS] All modified files have proper copyright headers

2. Golang Style Check

• [PASS] Code follows Go style conventions
• [PASS] Error handling is proper with fmt.Errorf wrapping
• [PASS] Variable naming follows Go conventions

3. Abstract Interface Check

• [PASS] Uses existing driver.Config and driver.Backend interfaces
• [PASS] TLS configuration is properly abstracted in buildTLSConfig

4. Architecture Check

• [PASS] Follows existing patterns for storage backend configuration
• [PASS] Proper separation of concerns between config, client, and backend

5. Security Review

• [PASS] TLS configuration follows security best practices
• [PASS] InsecureSkipVerify defaults to true for backward compatibility (documented)
• [PASS] Client certificate validation requires both cert and key files
• [PASS] CA file loading includes proper PEM validation

6. Code Quality Issues

Issue 1: Redundant nil check in loadRootCAs

File: internal/storage/elasticsearch/client.go:186-188

if rootCAs == nil {
    rootCAs = x509.NewCertPool()
}

The x509.SystemCertPool() error case already creates a new pool, and if it returns (nil, nil), the subsequent nil check handles it. However, the error case assignment rootCAs = x509.NewCertPool() followed by the nil check is redundant. Consider simplifying:

rootCAs, err := x509.SystemCertPool()
if err != nil || rootCAs == nil {
    rootCAs = x509.NewCertPool()
}

Issue 2: Missing context for file operations

File: internal/storage/elasticsearch/client.go:176

data, err := os.ReadFile(path)

Consider using os.ReadFile with context awareness if this function might be called in contexts where cancellation is needed.

7. Testing

• [PASS] Tests cover CA file loading
• [PASS] Tests cover client certificate loading
• [PASS] Tests cover incomplete cert/key configuration
• [PASS] Tests use proper test helpers and temp directories

Summary

This PR is well-implemented with proper error handling, security considerations, and test coverage. The TLS configuration follows Go best practices and maintains backward compatibility.

Recommendation: Approve with minor suggestions (Issue 1 is optional cleanup).