fix: 全量代码审计修复—安全/死代码/错误处理/配置净化

P0 安全修复:
  - 支付宝回调验签 (alipay_notify BTreeMap + rsa2_verify)
  - JWT fallback 'default_secret' 改为 .expect() (panic保底)
  - 安全响应头中间件 (CSP/X-Frame-Options/HSTS)

P1 死代码清理:
  - 移除孤儿文件 src/alipay.rs (284行, 无mod注册)
  - 移除Cargo未使用依赖 (actix-files/error/log/hex/digest)
  - log::info! → tracing::info! (auth.rs)
  - 移除 config.rs server_host + 3个TOML定义

P1 质量修复:
  - 修复 weather.rs unwrap() → unwrap_or
  - 修复 auth.rs+payment.rs 错误吞咽 (add tracing::warn)
  - 修复 main.rs 3x parse().unwrap → unwrap_or

P3 运维:
  - 新增 scripts/backup-db.sh (定时备份用)
  - 新增 README.md (快速入门文档)
  - deploy.sh 集成 backup-db.sh 上传

deploy.sh

@@ -856,6 +856,24 @@ upload_cleanup_script() {
     fi
 }
 
+# 上传备份脚本
+upload_backup_script() {
+    log_step "上传备份脚本..."
+    if [ "$DRY_RUN" = true ]; then
+        log_dry "rsync -avzP ./scripts/backup-db.sh '${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/scripts/'"
+        return 0
+    fi
+
+    mkdir -p ./scripts 2>/dev/null || true
+    if [ -f "./scripts/backup-db.sh" ]; then
+        rsync -avzP --progress ./scripts/backup-db.sh "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/scripts/"
+        ssh "${REMOTE_USER}@${REMOTE_HOST}" "chmod +x ${REMOTE_DIR}/scripts/backup-db.sh"
+        log_info "备份脚本上传完成"
+    else
+        log_warn "备份脚本不存在，跳过"
+    fi
+}
+
 # 重启远程服务
 restart_service() {
     log_step "重启服务 '${SERVICE_NAME}'..."
@@ -1525,6 +1543,7 @@ main() {
     upload_migrations
     upload_test_script
     upload_cleanup_script
+    upload_backup_script
     restart_service
     run_migrations