feat(iter-v2): T01 partial - TOKEN_SECRET check, SQL param, export credential, docs

- S2: logs.ts LIMIT/OFFSET SQL parameterization (? placeholders)
- S3: checkTokenSecret() startup validation, JWT_SECRET→TOKEN_SECRET in backup.ts
- S3: Access Token expiry shortened to 2h (from 30d)
- S4: Export download uses HMAC signed short-term token (/prepare endpoint)
- S4: Frontend export.ts adapted for prepare-then-download flow
- .env.example reorganized with security notes
- Added PRD and architecture docs for iteration v2

server/src/routes/logs.ts

@@ -157,15 +157,14 @@ router.get('/track/list', requireAdmin, async (req, res) => {
     )
     const total = (countResult as any[])[0].total
 
-    // LIMIT/OFFSET 直接嵌入 SQL（mysql2 execute 对这些参数类型要求严格）
     const [rows] = await pool.execute(
       `SELECT t.*, u.nickname
        FROM track_events t
        LEFT JOIN users u ON t.user_id = u.id
        WHERE ${where}
        ORDER BY t.created_at DESC
-       LIMIT ${pSize} OFFSET ${offset}`,
-      params
+       LIMIT ? OFFSET ?`,
+      [...params, pSize, offset]
     )
 
     res.json({