fix: 全量代码审计修复—安全/死代码/错误处理/配置净化

P0 安全修复:
  - 支付宝回调验签 (alipay_notify BTreeMap + rsa2_verify)
  - JWT fallback 'default_secret' 改为 .expect() (panic保底)
  - 安全响应头中间件 (CSP/X-Frame-Options/HSTS)

P1 死代码清理:
  - 移除孤儿文件 src/alipay.rs (284行, 无mod注册)
  - 移除Cargo未使用依赖 (actix-files/error/log/hex/digest)
  - log::info! → tracing::info! (auth.rs)
  - 移除 config.rs server_host + 3个TOML定义

P1 质量修复:
  - 修复 weather.rs unwrap() → unwrap_or
  - 修复 auth.rs+payment.rs 错误吞咽 (add tracing::warn)
  - 修复 main.rs 3x parse().unwrap → unwrap_or

P3 运维:
  - 新增 scripts/backup-db.sh (定时备份用)
  - 新增 README.md (快速入门文档)
  - deploy.sh 集成 backup-db.sh 上传

config/default.toml

@@ -7,4 +7,3 @@ ssl_cert_path = ""
 rust_log = "debug"
 environment = "development"
 free_user_data_limit = 100
-server_host = "0.0.0.0"

config/development.toml

@@ -6,4 +6,3 @@ ssl_cert_path = ""
 rust_log = "debug"
 environment = "development"
 free_user_data_limit = 100
-server_host = "0.0.0.0"

config/production.toml

@@ -5,4 +5,3 @@ ssl_cert_path = "/etc/ssl/certs/full_chain.pem"
 rust_log = "info"
 environment = "production"
 free_user_data_limit = 20
-server_host = "0.0.0.0"