feat(iter-v2): T01 complete - security + infrastructure

- S1: .githooks/pre-commit blocks .env commits, .env.test in .gitignore
- S3: TOKEN_SECRET centralized to config/token.ts, all files import from it
- S3: checkTokenSecret enforces min 32-char TOKEN_SECRET at startup
- S5: Refresh Token mechanism (Access 2h + Refresh 30d, dual token)
- S5: POST /auth/refresh endpoint with rotation and max 5 per user
- S5: Frontend request.ts auto-refresh on 40101, concurrent-safe
- S6: Soft delete (deleted_at column), admin soft-delete with confirmName
- S6: POST /admin/users/:id/restore endpoint
- S6: All user queries filter deleted_at IS NULL
- S7: DB connection requires env vars, no fallback credentials
- Infra: jest.config.js, vitest.config.ts, .env.test
- Infra: node-cron, jest, ts-jest, supertest, vitest, @pinia/testing

server/src/db/init.ts

@@ -311,16 +311,48 @@ async function runMigrations(conn: mysql.Connection) {
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
     `)
   }
+
+  // users 表添加软删除字段
+  const hasDeletedAt = await columnExists(conn, 'users', 'deleted_at')
+  if (!hasDeletedAt) {
+    console.log('[DB] Migrating: adding deleted_at to users')
+    await conn.query("ALTER TABLE users ADD COLUMN deleted_at DATETIME DEFAULT NULL COMMENT '软删除时间（NULL=正常）'")
+    await conn.query('ALTER TABLE users ADD INDEX idx_users_deleted (deleted_at)')
+    console.log('[DB] users.deleted_at added')
+  }
+
+  // Refresh Token 表
+  const hasRefreshTokens = await tableExists(conn, 'refresh_tokens')
+  if (!hasRefreshTokens) {
+    console.log('[DB] Migrating: creating refresh_tokens table')
+    await conn.query(`
+      CREATE TABLE IF NOT EXISTS refresh_tokens (
+        id INT AUTO_INCREMENT PRIMARY KEY,
+        user_id INT NOT NULL,
+        token_hash VARCHAR(64) NOT NULL COMMENT 'SHA-256(token)',
+        expires_at DATETIME NOT NULL COMMENT '过期时间',
+        revoked_at DATETIME DEFAULT NULL COMMENT '撤销时间（NULL=有效）',
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        INDEX idx_user (user_id),
+        INDEX idx_hash (token_hash),
+        FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
+    `)
+    console.log('[DB] refresh_tokens table created')
+  }
 }
 
 export async function initDatabase() {
-  const dbName = process.env.DB_NAME || 'xiaocai'
+  const dbName = process.env.DB_NAME!
+  const dbHost = process.env.DB_HOST!
+  const dbUser = process.env.DB_USER!
+  const dbPassword = process.env.DB_PASSWORD!
 
   // 先用不指定数据库的连接，确保数据库存在
   const bootstrap = await mysql.createConnection({
-    host: process.env.DB_HOST || 'localhost',
-    user: process.env.DB_USER || 'xiaocai',
-    password: process.env.DB_PASSWORD || 'xiaocai123',
+    host: dbHost,
+    user: dbUser,
+    password: dbPassword,
     multipleStatements: true,
   })
 
@@ -329,9 +361,9 @@ export async function initDatabase() {
 
   // 用独立连接执行建表和填充（需要 multipleStatements）
   const initConn = await mysql.createConnection({
-    host: process.env.DB_HOST || 'localhost',
-    user: process.env.DB_USER || 'xiaocai',
-    password: process.env.DB_PASSWORD || 'xiaocai123',
+    host: dbHost,
+    user: dbUser,
+    password: dbPassword,
     database: dbName,
     multipleStatements: true,
   })