chore: 生产配置移出版本库, 提供脱敏模板

backed/config.toml 内含生产数据库/Redis/JWT/captcha 凭证，随仓库分发
将导致凭证泄露（已实测凭仓库内 JWT 密钥可离线伪造超管 token）。
本地文件保留（git rm --cached 不删磁盘），新增 config.toml.example
脱敏模板说明部署方式；生产配置在服务器 /opt 下由容器挂载，不受影响。

.gitignore

@@ -6,6 +6,9 @@ backed/cmd/server/cpdaily-new
 backed/*.log
 backed/*.har
 
+# 本地/生产配置文件（含敏感凭证，禁止入库；模板见 backed/config.toml.example）
+backed/config.toml
+
 # Frontend build (rebuilt by Docker multi-stage)
 backed/dist/
 frondend/dist/

backed/config.toml

@@ -1,37 +0,0 @@
-[server]
-port = 8093
-mode = "release"
-
-[database]
-host = "10.10.10.128"
-port = 3306
-user = "xiaozhushou"
-password = "bh7S4JzPVyY0VLJh44i"
-dbname = "xiaozhushou"
-
-[jwt]
-secret = "cpdaily-new-jwt-secret-key-2026"
-accessExpire = 3600
-refreshExpire = 864000
-
-[captcha]
-width = 150
-height = 46
-length = 4
-
-[cpdaily]
-appVersion = "9.8.8"
-systemVersion = "iOS 17"
-calVersion = "first_v4"
-sliderIds = ["1018764144934965", "sdhyxy", "hqdx"]
-captchaBaseUrl = "http://10.10.10.128:8890"
-captchaApiKey = "baca122..."
-
-[agent]
-systemCdkPrice = 10.0
-
-[redis]
-host = "127.0.0.1"
-port = 6379
-password = "redis_4APk8B"
-db = 0

backed/config.toml.example

@@ -0,0 +1,43 @@
+# 配置文件模板：复制为 config.toml 并按环境填写真实值。
+# 注意：本文件随仓库分发，禁止填写任何真实凭证（数据库/Redis/JWT/第三方密钥）。
+# 生产配置存放于服务器 /opt/cpdaily-xiaozhushou/config.toml（容器以挂载方式读取），
+# 请勿将生产 config.toml 提交进 git。
+
+[server]
+port = 8093
+mode = "release"
+
+[database]
+host = "127.0.0.1"
+port = 3306
+user = "your_db_user"
+password = "your_db_password"
+dbname = "xiaozhushou"
+
+[jwt]
+# 生产环境必须使用强随机密钥（openssl rand -hex 32），示例值仅用于本地开发，切勿用于生产。
+secret = "dev-only-change-me-please"
+accessExpire = 3600
+refreshExpire = 864000
+
+[captcha]
+width = 150
+height = 46
+length = 4
+
+[cpdaily]
+appVersion = "9.8.8"
+systemVersion = "iOS 17"
+calVersion = "first_v4"
+sliderIds = ["1018764144934965", "sdhyxy", "hqdx"]
+captchaBaseUrl = "http://127.0.0.1:8890"
+captchaApiKey = "your_captcha_api_key"
+
+[agent]
+systemCdkPrice = 10.0
+
+[redis]
+host = "127.0.0.1"
+port = 6379
+password = "your_redis_password"
+db = 0