security(web): sanitize runtime map config

vehicle-data-platform/apps/web/scripts/prepare-dist.mjs

@@ -0,0 +1,12 @@
+import { copyFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const source = resolve(process.cwd(), 'public/app-config.example.js');
+const destination = resolve(process.cwd(), 'dist/app-config.js');
+
+// Vite copies public/app-config.js verbatim. That file is intentionally ignored
+// because developers may keep local AMap credentials in it. Never let those
+// machine-local values enter a production archive; the API renders the real
+// runtime configuration at /app-config.js on the server.
+copyFileSync(source, destination);
+