diff --git a/.env.production b/.env.production
old mode 100644
new mode 100755
index 341ce6ed9..19aeb8102
--- a/.env.production
+++ b/.env.production
@@ -45,12 +45,13 @@ CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
 # =======================
 # MinIO 对象存储配置
 # =======================
-MINIO_ENDPOINT=47.98.113.167:9000
-MINIO_ACCESS_KEY=CHANGE_ME_PRODUCTION
-MINIO_SECRET_KEY=CHANGE_ME_PRODUCTION
-MINIO_BUCKET=xiaoxia-assets
-MINIO_SECURE=false
-MINIO_PUBLIC_URL=http://47.98.113.167:9000
+# OSS 对象存储配置 (原 MINIO_* 配置已统一为 OSS_* 命名)
+OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
+OSS_ACCESS_KEY_ID=CHANGE_ME_PRODUCTION
+OSS_ACCESS_KEY_SECRET=CHANGE_ME_PRODUCTION
+OSS_BUCKET_NAME=xiaoxia-assets
+OSS_SECURE=false
+OSS_PUBLIC_URL=http://47.98.113.167:9000
 
 # =======================
 # 日志配置
diff --git a/.env.staging b/.env.staging
old mode 100644
new mode 100755
index 3775ad9c5..5472c3ddd
--- a/.env.staging
+++ b/.env.staging
@@ -45,12 +45,13 @@ CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
 # =======================
 # MinIO 对象存储配置
 # =======================
-MINIO_ENDPOINT=47.98.113.167:9000
-MINIO_ACCESS_KEY=CHANGE_ME_STAGING
-MINIO_SECRET_KEY=CHANGE_ME_STAGING
-MINIO_BUCKET=xiaoxia-assets
-MINIO_SECURE=false
-MINIO_PUBLIC_URL=http://47.98.113.167:9000
+# OSS 对象存储配置 (原 MINIO_* 配置已统一为 OSS_* 命名)
+OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
+OSS_ACCESS_KEY_ID=CHANGE_ME_STAGING
+OSS_ACCESS_KEY_SECRET=CHANGE_ME_STAGING
+OSS_BUCKET_NAME=xiaoxia-assets
+OSS_SECURE=false
+OSS_PUBLIC_URL=http://47.98.113.167:9000
 
 # =======================
 # 日志配置
diff --git a/apps/api/app/config.py b/apps/api/app/config.py
old mode 100644
new mode 100755
index f7258b386..b587cf4cc
--- a/apps/api/app/config.py
+++ b/apps/api/app/config.py
@@ -11,6 +11,11 @@ class Settings(BaseSettings):
     ENVIRONMENT: str = "development"
     DEBUG: bool = True
 
+    # 应用基础 URL，用于生成认证邮件中的链接
+    # 开发环境默认 http://localhost:3000
+    # 生产环境应通过环境变量 APP_BASE_URL 设置
+    APP_BASE_URL: str = "http://localhost:3000"
+
     # Container bind address; external expose is controlled by Docker/Nginx.
     API_HOST: str = "0.0.0.0"  # nosec: B104
     API_PORT: int = 8000
@@ -20,7 +25,7 @@ class Settings(BaseSettings):
         "postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas"
     )
     DATABASE_POOL_SIZE: int = 20
-    DATABASE_MAX_OVERFLOW: int = 40
+    DATABASE_MAX_OVERFLOW: int = 10  # 调整为合理值：pool_size(20) + max_overflow(10) = 最大30连接
     DATABASE_POOL_TIMEOUT: int = 30
     DATABASE_POOL_RECYLE: int = 3600
     USE_IN_MEMORY_DB: bool = False
@@ -32,6 +37,11 @@ class Settings(BaseSettings):
 
     # JWT secret key - MUST be set via environment variable, no default allowed
     JWT_SECRET_KEY: Optional[str] = None
+    # 旧的 JWT secret key（用于密钥轮换期间验证旧 token）
+    # 在密钥轮换时，先设置新密钥，旧密钥保留在此处直到所有旧 token 过期
+    JWT_SECRET_KEY_OLD: Optional[str] = None
+    # 密钥轮换天数（到达此天数后建议更换密钥）
+    SECRET_ROTATION_DAYS: int = 90
 
     @field_validator("JWT_SECRET_KEY", mode="before")
     @classmethod