fix: 全量代码审计修复—安全/死代码/错误处理/配置净化

P0 安全修复:
  - 支付宝回调验签 (alipay_notify BTreeMap + rsa2_verify)
  - JWT fallback 'default_secret' 改为 .expect() (panic保底)
  - 安全响应头中间件 (CSP/X-Frame-Options/HSTS)

P1 死代码清理:
  - 移除孤儿文件 src/alipay.rs (284行, 无mod注册)
  - 移除Cargo未使用依赖 (actix-files/error/log/hex/digest)
  - log::info! → tracing::info! (auth.rs)
  - 移除 config.rs server_host + 3个TOML定义

P1 质量修复:
  - 修复 weather.rs unwrap() → unwrap_or
  - 修复 auth.rs+payment.rs 错误吞咽 (add tracing::warn)
  - 修复 main.rs 3x parse().unwrap → unwrap_or

P3 运维:
  - 新增 scripts/backup-db.sh (定时备份用)
  - 新增 README.md (快速入门文档)
  - deploy.sh 集成 backup-db.sh 上传

Cargo.lock

@@ -19,29 +19,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "actix-files"
-version = "0.6.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c0d87f10d70e2948ad40e8edea79c8e77c6c66e0250a4c1f09b690465199576"
-dependencies = [
- "actix-http",
- "actix-service",
- "actix-utils",
- "actix-web",
- "bitflags",
- "bytes",
- "derive_more",
- "futures-core",
- "http-range",
- "log",
- "mime",
- "mime_guess",
- "percent-encoding",
- "pin-project-lite",
- "v_htmlescape",
-]
-
 [[package]]
 name = "actix-http"
 version = "3.11.1"
@@ -649,16 +626,6 @@ dependencies = [
  "windows-sys 0.61.0",
 ]
 
-[[package]]
-name = "error"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6e606f14042bb87cc02ef6a14db6c90ab92ed6f62d87e69377bc759fd7987cc"
-dependencies = [
- "traitobject",
- "typeable",
-]
-
 [[package]]
 name = "etcetera"
 version = "0.8.0"
@@ -1005,12 +972,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "http-range"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21dec9db110f5f872ed9699c3ecf50cf16f423502706ba5c72462e28d3157573"
-
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -1461,16 +1422,6 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
-[[package]]
-name = "mime_guess"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
-dependencies = [
- "mime",
- "unicase",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1963,17 +1914,12 @@ dependencies = [
 name = "rust-backend"
 version = "0.3.0"
 dependencies = [
- "actix-files",
  "actix-web",
  "base64",
  "chrono",
- "digest",
  "dotenvy",
- "error",
- "hex",
  "include_dir",
  "jsonwebtoken",
- "log",
  "openssl",
  "pkcs8",
  "rand 0.8.5",
@@ -2898,36 +2844,18 @@ dependencies = [
  "tracing-serde",
 ]
 
-[[package]]
-name = "traitobject"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04a79e25382e2e852e8da874249358d382ebaf259d0d34e75d8db16a7efabbc7"
-
 [[package]]
 name = "try-lock"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
-[[package]]
-name = "typeable"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1410f6f91f21d1612654e7cc69193b0334f909dcf2c790c4826254fbb86f8887"
-
 [[package]]
 name = "typenum"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
-[[package]]
-name = "unicase"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
-
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -2996,12 +2924,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "v_htmlescape"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e8257fbc510f0a46eb602c10215901938b5c2a7d5e70fc11483b1d3c9b5b18c"
-
 [[package]]
 name = "valuable"
 version = "0.1.1"