fix: 全量代码审计修复—安全/死代码/错误处理/配置净化

P0 安全修复:
  - 支付宝回调验签 (alipay_notify BTreeMap + rsa2_verify)
  - JWT fallback 'default_secret' 改为 .expect() (panic保底)
  - 安全响应头中间件 (CSP/X-Frame-Options/HSTS)

P1 死代码清理:
  - 移除孤儿文件 src/alipay.rs (284行, 无mod注册)
  - 移除Cargo未使用依赖 (actix-files/error/log/hex/digest)
  - log::info! → tracing::info! (auth.rs)
  - 移除 config.rs server_host + 3个TOML定义

P1 质量修复:
  - 修复 weather.rs unwrap() → unwrap_or
  - 修复 auth.rs+payment.rs 错误吞咽 (add tracing::warn)
  - 修复 main.rs 3x parse().unwrap → unwrap_or

P3 运维:
  - 新增 scripts/backup-db.sh (定时备份用)
  - 新增 README.md (快速入门文档)
  - deploy.sh 集成 backup-db.sh 上传

src/handlers/auth.rs

@@ -509,7 +509,7 @@ pub async fn web_login_confirm(
     app_state: web::Data<AppState>,
 ) -> impl Responder {
     let short_code = req.code.trim();
-    log::info!("[web_login_confirm] received code={}", short_code);
+    tracing::info!("[web_login_confirm] received code={}", short_code);
 
     // 精确匹配登录码
     let record: Option<(String, String, chrono::DateTime<chrono::Utc>, Option<i32>)> =
@@ -519,6 +519,7 @@ pub async fn web_login_confirm(
         .bind(short_code)
         .fetch_optional(pool.get_ref())
         .await
+        .inspect_err(|e| tracing::warn!("数据库查询登录码失败: {}", e))
         .ok()
         .flatten();
 
@@ -537,10 +538,13 @@ pub async fn web_login_confirm(
     // 检查是否过期
     if Utc::now() > expires_at {
         // 清理过期码
-        let _ = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
+        if let Err(e) = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
             .bind(&code)
             .execute(pool.get_ref())
-            .await;
+            .await
+        {
+            tracing::warn!("清理过期登录码失败: {}", e);
+        }
         return HttpResponse::Ok().json(WebLoginConfirmResponse {
             success: false,
             token: None,
@@ -597,12 +601,14 @@ pub async fn web_login_confirm(
         };
 
     // 更新登录码记录，设置 token（而非删除，让轮询接口能查到）
-    sqlx::query("UPDATE web_login_codes SET token = $1 WHERE code = $2")
+    if let Err(e) = sqlx::query("UPDATE web_login_codes SET token = $1 WHERE code = $2")
         .bind(&token)
         .bind(&code)
         .execute(pool.get_ref())
         .await
-        .ok();
+    {
+        tracing::warn!("更新登录码 token 失败: {}", e);
+    }
 
     info!("[WEB LOGIN CONFIRM] user_id={} is_paid={}", user_id, is_paid_active);
     HttpResponse::Ok().json(WebLoginConfirmResponse {