fix(api_key): validate application publication status before key generation

- Ensure the application exists and is published when resource_id is present; raise an exception otherwise.

api/app/services/api_key_service.py

@@ -65,6 +65,11 @@ class ApiKeyService:
                         BizCode.BAD_REQUEST
                     )
 
+            if data.resource_id:
+                app = db.get(App, data.resource_id)
+                if not app or not app.current_release_id:
+                    raise BusinessException("该应用未发布", BizCode.APP_NOT_PUBLISHED)
+
             # 生成 API Key
             api_key = generate_api_key(data.type)