1) Import addresses as watch-only; 2) Use an HD wallet, and save the master private key offline; 3) Construct raw transaction online, send it to offline signing. How's my private key exposed?

Yes. You probably need to periodically import a batch of addresses into the wallet, as a production site, however that's more of a topic of software engeering. As for safety measure, if you are generating those addresses, it's recommended to use HD wallet so your private keys won't get exposed.

interesting. This goes back to the original question, if the counterparty can take the money via revocation inside the HTLC-success tx, what's the point of having a revocation inside the commitment tx?

Let's say I'm the local node who is cheating. I have to spend it via a HTLC-success tx, which has a revocation inside it. Once I spend the commitment tx, I have to wait to_self_delay time before I can spend the HTLC-success tx, meanwhile, the counterparty can take the money via the revocation?

If you publish an old commitment tx with 1 received HTLC, the counterparty can enter the timeout process as specified in cltv_expiry and then collect the money via HTLC-timeout anyway? So your point is that we don't want the counterparty to wait that long if you cheat? You don't seem to have a good reason to publish this tx though pure harm may be wanted.