refactor(stage4): 集中配置与启动校验，权限守卫 fail-closed，凭据移出仓库

配置分层
- 新增 src/server/config.ts：环境变量集中读取 + 启动期校验。
  删除公开兜底密钥 ln-bi-default-secret：SSO 模式下 JWT_SECRET 缺失或
  短于 32 字符时 assertRuntimeConfig() 直接拒绝启动（已实测）。
- index.ts 不再自己读端口/环境；auth/config.ts 与 auth/login.ts 改为引用集中配置。

权限守卫
- energy / scheduling / hydrogen-heatmap 的守卫由 “user 存在才校验” 改为
  “无角色即拒绝”：user 缺失时按无权限处理，不再静默放行（fail-closed）。
- /api/ele/* 此前完全无鉴权，任何已登录用户都能写入电费表；现按能源域
  (BI-LEADER-ENERGY) 守卫。

接口契约
- 未匹配的 /api/* 由 200 text/html(SPA) 改为 404 application/json；
  未认证时仍是 401，避免向未授权调用方暴露路由是否存在。
- 新增全局 onError 返回 JSON 500。

凭据治理（此前均为 git 跟踪文件中的明文）
- Dockerfile 删除烧进镜像的 JWT_SECRET，改为必须运行时注入。
- docker-compose.yml 删除生产库口令/JWT 密钥/失效的 MILEAGE_DB_*，
  改为强制注入写法；补齐 OSS_* 与 NODE_ENV/DEV_BYPASS_AUTH/BI_AUTH_*。
- woodpecker.yml 删除 Harbor base64 凭据改用 secret，pull_request 不再推镜像。
- 删除 scripts-tmp/（含生产库 root 口令）与已跟踪的 .DS_Store；.gitignore 补全。
- 文档中残留的里程库口令改为占位符。

lint / test(128) / build 全绿。

scripts-tmp/find_extra.ts

@@ -1,60 +0,0 @@
-import mysql from 'mysql2/promise';
-import fs from 'node:fs';
-
-const pool = mysql.createPool({
-  host: 'rm-uf65w5v2r77n674x2.mysql.rds.aliyuncs.com',
-  port: 3306,
-  user: 'root',
-  password: 'LN#Passw0rd@2026',
-  database: 'lingniu_prod',
-  connectTimeout: 15000, ssl: { rejectUnauthorized: false },
-});
-
-async function main() {
-  const excelPlates = new Set(
-    fs.readFileSync('/Users/kkfluous/Projects/ai-coding/ln-bi/scripts-tmp/excel_plates.txt', 'utf8').trim().split('\n').map((s) => s.trim())
-  );
-  console.log('excel plates:', excelPlates.size);
-
-  // 按 dept-stats 逻辑查金可鹏 18T Operating
-  const [rows] = await pool.query<any[]>(`
-    SELECT truck.plate_number AS plate,
-           dic_type.dic_name AS type_label,
-           dic_status.dic_name AS status_label,
-           cus.customer_name AS customer,
-           org_truck.org_name AS subject_org
-    FROM tab_truck truck
-    LEFT JOIN tab_dic dic_type ON dic_type.parent_code='dic_truck_type' AND dic_type.dic_code=truck.model AND dic_type.is_deleted=0
-    LEFT JOIN tab_dic dic_status ON dic_status.parent_code='dic_truck_rent_status' AND dic_status.dic_code=truck.truck_rent_status AND dic_status.is_deleted=0
-    LEFT JOIN tab_truck_status_info si ON si.truck_id=truck.id AND si.is_deleted=0
-    LEFT JOIN tab_contract c ON c.id=si.contract_id AND c.is_deleted=0
-    LEFT JOIN tab_customer cus ON cus.id=c.customer_id AND cus.is_deleted=0
-    LEFT JOIN tab_org org_truck ON org_truck.id=truck.org_id AND org_truck.is_deleted=0
-    LEFT JOIN tab_user u ON u.id=c.bd AND u.is_deleted=0
-    WHERE truck.is_deleted=0 AND truck.is_operation=1
-      AND u.user_name='金可鹏'
-      AND dic_type.dic_name LIKE '%18吨%'
-      AND dic_status.dic_name IN ('租赁','自营','挂靠')
-    ORDER BY truck.plate_number
-  `);
-
-  console.log('DB 金可鹏 18T operating:', rows.length);
-  const dbPlates = new Set((rows as any[]).map((r) => (r.plate || '').trim()));
-
-  const extra = [...dbPlates].filter((p) => !excelPlates.has(p)).sort();
-  const missing = [...excelPlates].filter((p) => !dbPlates.has(p)).sort();
-
-  console.log('\n=== DB 有但 Excel 没有（多出来的） ===');
-  console.log('数量:', extra.length);
-  for (const p of extra) {
-    const r = (rows as any[]).find((x) => x.plate === p);
-    console.log(' ', p, '|', r?.type_label, '|', r?.customer, '|', r?.subject_org);
-  }
-
-  console.log('\n=== Excel 有但 DB 没有 ===');
-  console.log('数量:', missing.length);
-  for (const p of missing) console.log(' ', p);
-
-  await pool.end();
-}
-main().catch((e) => { console.error(e); process.exit(1); });