feat(iter-v2): T01 complete - security + infrastructure

- S1: .githooks/pre-commit blocks .env commits, .env.test in .gitignore
- S3: TOKEN_SECRET centralized to config/token.ts, all files import from it
- S3: checkTokenSecret enforces min 32-char TOKEN_SECRET at startup
- S5: Refresh Token mechanism (Access 2h + Refresh 30d, dual token)
- S5: POST /auth/refresh endpoint with rotation and max 5 per user
- S5: Frontend request.ts auto-refresh on 40101, concurrent-safe
- S6: Soft delete (deleted_at column), admin soft-delete with confirmName
- S6: POST /admin/users/:id/restore endpoint
- S6: All user queries filter deleted_at IS NULL
- S7: DB connection requires env vars, no fallback credentials
- Infra: jest.config.js, vitest.config.ts, .env.test
- Infra: node-cron, jest, ts-jest, supertest, vitest, @pinia/testing

server/src/middleware/auth.ts

@@ -1,15 +1,15 @@
 import { Request, Response, NextFunction } from 'express'
 import { createHmac, timingSafeEqual } from 'crypto'
+import { TOKEN_SECRET } from '../config/token'
 
 export interface AuthRequest extends Request {
   userId?: number
 }
 
-const TOKEN_SECRET = process.env.TOKEN_SECRET || 'xiaocai-token-secret-change-in-production'
 const TOKEN_EXPIRY = 2 * 60 * 60 * 1000 // 2 hours
 
 // 不需要认证的路径
-const PUBLIC_PATHS = ['/api/auth/login', '/api/auth/demo-login', '/api/health']
+const PUBLIC_PATHS = ['/api/auth/login', '/api/auth/demo-login', '/api/auth/refresh', '/api/health']
 
 export function authMiddleware(req: AuthRequest, res: Response, next: NextFunction) {
   // 公开路径跳过认证