feat(iter-v2): T01 partial - TOKEN_SECRET check, SQL param, export credential, docs

- S2: logs.ts LIMIT/OFFSET SQL parameterization (? placeholders)
- S3: checkTokenSecret() startup validation, JWT_SECRET→TOKEN_SECRET in backup.ts
- S3: Access Token expiry shortened to 2h (from 30d)
- S4: Export download uses HMAC signed short-term token (/prepare endpoint)
- S4: Frontend export.ts adapted for prepare-then-download flow
- .env.example reorganized with security notes
- Added PRD and architecture docs for iteration v2

server/src/middleware/auth.ts

@@ -6,7 +6,7 @@ export interface AuthRequest extends Request {
 }
 
 const TOKEN_SECRET = process.env.TOKEN_SECRET || 'xiaocai-token-secret-change-in-production'
-const TOKEN_EXPIRY = 30 * 24 * 60 * 60 * 1000 // 30 days
+const TOKEN_EXPIRY = 2 * 60 * 60 * 1000 // 2 hours
 
 // 不需要认证的路径
 const PUBLIC_PATHS = ['/api/auth/login', '/api/auth/demo-login', '/api/health']