fix(security): 删除 .env.production 并清理硬编码密码

- 删除 .env.production（含占位符密钥，已从版本控制移除）
- scripts/smoke_public_*.py: 密码改为从环境变量 SMOKE_TEST_PASSWORD 读取
- infra/docker/infra.yml: POSTGRES_PASSWORD 改为引用环境变量
- packages/application/auth/jwt_handler.py: 文档示例密钥改为占位符

scripts/smoke_public_auth_flow.py

@@ -8,6 +8,7 @@ login, /auth/me, and /workspaces. Uses only the Python standard library.
 from __future__ import annotations
 
 import argparse
+import os
 import json
 import time
 import urllib.error
@@ -41,7 +42,7 @@ def main() -> int:
     timestamp = int(time.time())
     email = f"smoke-{timestamp}@example.com"
     username = f"smoke{timestamp}"
-    password = "AuditPass123!"
+    password = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
     register_status, register_body = request_json(
         "POST",

scripts/smoke_public_boundary_flow.py

@@ -4,10 +4,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict:

scripts/smoke_public_upload_flow.py

@@ -10,10 +10,11 @@ import io
 import time
 import uuid
 
+import os
 import requests
 
 BASE_URL = "https://saas.xiaoxiajianji.com/api/v1"
-PASSWORD = "SmokePass123!"
+PASSWORD = os.environ.get("SMOKE_TEST_PASSWORD", "changeme")
 
 
 def _json_or_raise(name: str, response: requests.Response) -> dict: