fix: fail closed on production settings

backend/app/config.py

@@ -2,6 +2,7 @@
 
 from pydantic import Field
 from pydantic_settings import BaseSettings
+from typing import Literal
 
 
 LEGACY_DEFAULT_SECRET = "change-me-to-a-long-random-string"
@@ -9,7 +10,7 @@ LEGACY_DEFAULT_SECRET = "change-me-to-a-long-random-string"
 
 class Settings(BaseSettings):
     # ---------- 运行环境 ----------
-    environment: str = "development"
+    environment: Literal["development", "test", "production"] = "development"
 
     # ---------- 数据库 ----------
     DATABASE_URL: str = "sqlite+aiosqlite:///./pingwatch.db"

backend/app/services/settings_validation.py

@@ -6,7 +6,7 @@ from app.config import LEGACY_DEFAULT_SECRET, Settings
 def validate_runtime_settings(settings: Settings) -> None:
     """Reject unsafe settings before scheduling monitoring work."""
     if settings.environment == "production":
-        if settings.secret_key == LEGACY_DEFAULT_SECRET:
+        if not settings.secret_key.strip() or settings.secret_key == LEGACY_DEFAULT_SECRET:
             raise ValueError("SECRET_KEY must be provided by the runtime environment")
         if not settings.casdoor_endpoint.startswith("https://"):
             raise ValueError("CASDOOR endpoint must use TLS in production")