refactor(conf): route remaining global config reads through provider

The last three live readers of pkg/conf mutable globals (grace period,
unix socket perm, CORS same-site/secure) now read via ConfigProvider,
matching every other consumer. The globals remain as ini bind targets.

Authored By: TDvorak <info@tdvorak.dev>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

application/application.go

@@ -188,7 +188,7 @@ func (s *server) Close() {
 	}
 
 	ctx := context.Background()
-	if conf.SystemConfig.GracePeriod != 0 {
+	if s.config.System().GracePeriod != 0 {
 		var cancel context.CancelFunc
 		ctx, cancel = context.WithTimeout(ctx, time.Duration(s.config.System().GracePeriod)*time.Second)
 		defer cancel()
@@ -231,8 +231,8 @@ func (s *server) runUnix(server *http.Server) error {
 	defer listener.Close()
 	defer os.Remove(s.config.Unix().Listen)
 
-	if conf.UnixConfig.Perm > 0 {
+	if s.config.Unix().Perm > 0 {
-		err = os.Chmod(conf.UnixConfig.Listen, os.FileMode(s.config.Unix().Perm))
+		err = os.Chmod(s.config.Unix().Listen, os.FileMode(s.config.Unix().Perm))
 		if err != nil {
 			s.logger.Warning(
 				"Failed to set permission to %q for socket file %q: %s",

middleware/session.go

@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/cloudreve/Cloudreve/v4/pkg/conf"
 	"github.com/cloudreve/Cloudreve/v4/pkg/serializer"
 	"github.com/cloudreve/Cloudreve/v4/pkg/util"
 	"github.com/gin-contrib/sessions"
@@ -22,7 +21,7 @@ const SessionName = "cloudreve-session"
 func Session(dep dependency.Dep) gin.HandlerFunc {
 	Store = sessionstore.NewStore(dep.KV(), []byte(dep.ConfigProvider().System().SessionSecret))
 	sameSiteMode := http.SameSiteDefaultMode
-	switch strings.ToLower(conf.CORSConfig.SameSite) {
+	switch strings.ToLower(dep.ConfigProvider().Cors().SameSite) {
 	case "default":
 		sameSiteMode = http.SameSiteDefaultMode
 	case "none":
@@ -39,7 +38,7 @@ func Session(dep dependency.Dep) gin.HandlerFunc {
 		MaxAge:   60 * 86400,
 		Path:     "/",
 		SameSite: sameSiteMode,
-		Secure:   conf.CORSConfig.Secure,
+		Secure:   dep.ConfigProvider().Cors().Secure,
 	})
 
 	return sessions.Sessions(SessionName, Store)