feat(iter-v2): T01 partial - TOKEN_SECRET check, SQL param, export credential, docs

- S2: logs.ts LIMIT/OFFSET SQL parameterization (? placeholders)
- S3: checkTokenSecret() startup validation, JWT_SECRET→TOKEN_SECRET in backup.ts
- S3: Access Token expiry shortened to 2h (from 30d)
- S4: Export download uses HMAC signed short-term token (/prepare endpoint)
- S4: Frontend export.ts adapted for prepare-then-download flow
- .env.example reorganized with security notes
- Added PRD and architecture docs for iteration v2

server/src/routes/auth.ts

@@ -8,6 +8,18 @@ const APPID = process.env.WX_APPID || ''
 const SECRET = process.env.WX_SECRET || ''
 const TOKEN_SECRET = process.env.TOKEN_SECRET || 'xiaocai-token-secret-change-in-production'
 
+/** 启动时检查 TOKEN_SECRET 是否为默认占位符，是则拒绝启动 */
+export function checkTokenSecret(): void {
+  const defaults = [
+    'xiaocai-token-secret-change-in-production',
+    'change-me-to-a-secure-random-string',
+  ]
+  if (defaults.includes(TOKEN_SECRET)) {
+    console.error('[Auth] FATAL: TOKEN_SECRET is using a default placeholder. Set a secure TOKEN_SECRET in .env before starting the server.')
+    process.exit(1)
+  }
+}
+
 export function signToken(userId: number): string {
   const payload = `${userId}:${Date.now()}`
   const signature = createHmac('sha256', TOKEN_SECRET).update(payload).digest('hex')