fix(security): 删除 .env.production 并清理硬编码密码

- 删除 .env.production（含占位符密钥，已从版本控制移除）
- scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量
- packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符

.env.production

@@ -1,86 +0,0 @@
-# =======================
-# 生产环境配置
-# =======================
-APP_ENV=production
-APP_NAME=xiaoxia-saas
-APP_VERSION=0.1.0
-DEBUG=false
-
-# =======================
-# API 服务配置
-# =======================
-API_HOST=0.0.0.0
-API_PORT=8000
-API_PREFIX=/api/v1
-
-# =======================
-# Web 前端配置
-# =======================
-WEB_PORT=3000
-WEB_URL=https://xiaoxiajianji.com
-
-# =======================
-# 数据库配置
-# =======================
-DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME@postgres:5432/xiaoxia_saas_production
-DATABASE_POOL_SIZE=50
-DATABASE_MAX_OVERFLOW=100
-DATABASE_POOL_TIMEOUT=30
-DATABASE_POOL_RECYCLE=3600
-
-# =======================
-# Redis 配置
-# =======================
-REDIS_URL=redis://redis:6379/0
-REDIS_MAX_CONNECTIONS=100
-
-# =======================
-# Celery Worker 配置
-# =======================
-CELERY_BROKER_URL=redis://redis:6379/0
-CELERY_RESULT_BACKEND=redis://redis:6379/1
-CELERY_WORKER_CONCURRENCY=8
-CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
-
-# =======================
-# MinIO 对象存储配置
-# =======================
-# OSS 对象存储配置 (原 MINIO_* 配置已统一为 OSS_* 命名)
-OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
-OSS_ACCESS_KEY_ID=CHANGE_ME_PRODUCTION
-OSS_ACCESS_KEY_SECRET=CHANGE_ME_PRODUCTION
-OSS_BUCKET_NAME=xiaoxia-assets
-OSS_SECURE=false
-OSS_PUBLIC_URL=http://47.98.113.167:9000
-
-# =======================
-# 日志配置
-# =======================
-LOG_LEVEL=INFO
-LOG_FORMAT=json
-LOG_FILE=/var/log/xiaoxia-saas/app.log
-
-# =======================
-# CORS 配置
-# =======================
-CORS_ORIGINS=https://xiaoxiajianji.com,https://api.xiaoxiajianji.com
-CORS_ALLOW_CREDENTIALS=true
-
-# =======================
-# 文件上传限制
-# =======================
-MAX_UPLOAD_SIZE_MB=2000
-ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif
-
-# =======================
-# 安全配置
-# =======================
-SECRET_KEY=CHANGE_ME_TO_RANDOM_STRING_AT_LEAST_32_CHARS_IN_PRODUCTION
-ACCESS_TOKEN_EXPIRE_MINUTES=60
-REFRESH_TOKEN_EXPIRE_DAYS=7
-
-# =======================
-# 监控与追踪（可选）
-# =======================
-# SENTRY_DSN=
-# PROMETHEUS_PORT=9090

infra/docker/infra.yml

@@ -8,7 +8,7 @@ services:
     environment:
       POSTGRES_DB: xiaoxia_saas
       POSTGRES_USER: xiaoxia
-      POSTGRES_PASSWORD: xiaoxia_password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme_in_production}
     ports:
       - "5432:5432"
     volumes:

packages/application/auth/jwt_handler.py

@@ -7,7 +7,7 @@ JWT 处理器委托层
 使用方式：
     from packages.application.auth.jwt_handler import JWTHandler, get_jwt_handler
     
-    jwt_handler = JWTHandler(secret_key="your-secret-key")
+    jwt_handler = JWTHandler(secret_key="<YOUR_SECRET_KEY>")
     token = jwt_handler.create_access_token(user_id="user123", workspace_id="ws456", role="admin")
     payload = jwt_handler.verify_access_token(token)
 """

scripts/smoke_public_auth_flow.py

@@ -8,6 +8,7 @@ login, /auth/me, and /workspaces. Uses only the Python standard library.
 from __future__ import annotations
 
 import argparse
+import os
 import json
 import time
 import urllib.error
@@ -41,7 +42,7 @@ def main() -> int:
     timestamp = int(time.time())
     email = f"smoke-{timestamp}@example.com"
     username = f"smoke{timestamp}"
-    password = "AuditPass123!"
+    password = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
     register_status, register_body = request_json(
         "POST",

scripts/smoke_public_boundary_flow.py

@@ -4,10 +4,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict:

scripts/smoke_public_upload_flow.py

@@ -10,10 +10,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict: