feat(iter-v2): T01 partial - TOKEN_SECRET check, SQL param, export credential, docs

- S2: logs.ts LIMIT/OFFSET SQL parameterization (? placeholders)
- S3: checkTokenSecret() startup validation, JWT_SECRET→TOKEN_SECRET in backup.ts
- S3: Access Token expiry shortened to 2h (from 30d)
- S4: Export download uses HMAC signed short-term token (/prepare endpoint)
- S4: Frontend export.ts adapted for prepare-then-download flow
- .env.example reorganized with security notes
- Added PRD and architecture docs for iteration v2

client/src/api/export.ts

@@ -9,24 +9,18 @@ export interface ExportParams {
   format?: 'csv' | 'json'
 }
 
-/** 请求服务端导出（返回流） */
-export function requestExport(params: ExportParams) {
-  return request<{ downloadUrl: string }>({
-    url: '/export',
+/** 准备导出：获取短期签名 token */
+export function prepareExport(params: ExportParams) {
+  return request<{ token: string }>({
+    url: '/export/prepare',
     data: { ...params, format: params.format || 'csv' }
   })
 }
 
-/** 获取服务端导出下载 URL */
-export function getExportUrl(params: ExportParams): string {
+/** 获取服务端导出下载 URL（使用短期签名 token） */
+export async function getExportUrl(params: ExportParams): Promise<string> {
+  const { token } = await prepareExport(params)
   const query = new URLSearchParams()
-  query.set('startDate', params.startDate)
-  query.set('endDate', params.endDate)
-  if (params.type) query.set('type', params.type)
-  if (params.format) query.set('format', params.format)
-
-  const token = uni.getStorageSync('xc:token')
-  if (token) query.set('token', token)
-
+  query.set('token', token)
   return `${API_BASE}/export?${query.toString()}`
 }

client/src/pages/profile/index.vue

@@ -457,7 +457,7 @@ async function doExport() {
     exportLoading.value = true
     try {
       const { getExportUrl } = await import('@/api/export')
-      const url = getExportUrl({
+      const url = await getExportUrl({
         startDate: exportStartDate.value,
         endDate: exportEndDate.value,
         type: exportType.value,