feat(iter-v2): T01 partial - TOKEN_SECRET check, SQL param, export credential, docs

- S2: logs.ts LIMIT/OFFSET SQL parameterization (? placeholders)
- S3: checkTokenSecret() startup validation, JWT_SECRET→TOKEN_SECRET in backup.ts
- S3: Access Token expiry shortened to 2h (from 30d)
- S4: Export download uses HMAC signed short-term token (/prepare endpoint)
- S4: Frontend export.ts adapted for prepare-then-download flow
- .env.example reorganized with security notes
- Added PRD and architecture docs for iteration v2

server/.env.example

@@ -1,24 +1,21 @@
 # Server
 PORT=3000
 
-# Security
-TOKEN_SECRET=your_random_secret_here
-
-# CORS (comma-separated origins, empty = allow all)
-CORS_ORIGINS=
-
 # MySQL
-DB_HOST=your_mysql_host_here
-DB_USER=your_mysql_user_here
-DB_PASSWORD=your_mysql_password_here
-DB_NAME=your_mysql_name_here
+DB_HOST=your_db_host
+DB_USER=your_db_user
+DB_PASSWORD=your_db_password
+DB_NAME=xiaocai
 
 # Uploads
 UPLOAD_DIR=./uploads
 
 # Backup
-BACKUP_DIR=/var/backups/xiaocai
+BACKUP_DIR=./backups
+
+# Token (REQUIRED - server will not start with default value)
+TOKEN_SECRET=change-me-to-a-secure-random-string
 
 # WeChat Mini Program
-WX_APPID=your_wx_appid_here
-WX_SECRET=your_wx_secret_here
+WX_APPID=your_wx_appid
+WX_SECRET=your_wx_secret