security: externalize BI data source credentials

src/server/routes/energy/index.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import type { RowDataPacket } from 'mysql2';
 import pool from '../../db.js';
-import hydrogenPool from '../../hydrogen-db.js';
+import { getHydrogenPool } from '../../hydrogen-db.js';
 import { cached } from './cache.js';
 import {
   parseHydrogenCustomerKind,
@@ -147,6 +147,7 @@ app.get('/hydrogen/overview', async (c) => {
   const requestedYear = yearParam ? Number(yearParam) || todayYear : todayYear;
 
   const data = await cached(`hydrogen/overview?year=${requestedYear}`, async () => {
+  const hydrogenPool = getHydrogenPool();
   // 可选年份（数据自 HYDROGEN_MIN_DATE 起）
   const [yearListRows] = await hydrogenPool.query<RowDataPacket[]>(
     `SELECT DISTINCT YEAR(${HYDROGEN_LOCAL}) AS y
@@ -412,6 +413,7 @@ app.get('/hydrogen/daily', async (c) => {
   const force = c.req.query('force') === '1';
 
   const data = await cached(`hydrogen/daily?start=${dateRange.start}&end=${dateRange.end}&customer=${customer}&station=${stationId ?? 'all'}&customerName=${encodeURIComponent(customerName ?? 'all')}`, async () => {
+  const hydrogenPool = getHydrogenPool();
 
   const whereParts = [
     HYDROGEN_BASE_WHERE_B,