fix(security): remediate telecom compliance findings

backend/.env.example

@@ -5,11 +5,13 @@
 
 # ── 应用 ──
 APP_NAME=企迹-政企周报管理系统
-DEBUG=true
-SECRET_KEY=change-me-to-a-random-string-in-production
+ENVIRONMENT=development
+DEBUG=false
+# Use a random value of at least 32 characters. Never use a default in production.
+SECRET_KEY=replace-with-a-random-secret-of-at-least-32-characters
 
 # ── PostgreSQL (已有基础设施，填写实际连接信息) ──
-DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/qiji
+DATABASE_URL=postgresql+asyncpg://qiji_app:replace-with-a-strong-password@localhost:5432/qiji
 
 # ── JWT ──
 JWT_ALGORITHM=HS256
@@ -25,10 +27,11 @@ CASDOOR_APPLICATION=qiji-weekly-report
 
 # ── MinIO (已有，填写实际部署地址和密钥) ──
 MINIO_ENDPOINT=localhost:9000
-MINIO_ACCESS_KEY=minioadmin
-MINIO_SECRET_KEY=minioadmin
+MINIO_ACCESS_KEY=qiji-app
+MINIO_SECRET_KEY=replace-with-a-strong-minio-secret
 MINIO_BUCKET=qiji-photos
-MINIO_SECURE=false
+# Set false only when connecting to a local development MinIO instance over the internal Docker network.
+MINIO_SECURE=true
 
 # ── 企业微信 (需在企微管理后台创建自建应用后获取) ──
 WECOM_CORP_ID=your-corp-id