feat(deploy): 补齐凭据加密接入迁移和密钥备份恢复

首次安装默认生成独立加密密钥，更新旧部署保留原配置，通过显式开关进入迁移窗口。增加生产迁移包装入口和完整密钥环备份恢复工具，并说明旧镜像升级、严格迁移、轮换及还原流程。

已通过 Bash 安全环境及密钥备份回归；对应 PowerShell 5.1 和 7 脚本已在 Windows 原生环境各通过 49 项验收。宁波服务器验收尚未执行。

scripts/Test-SecurityEnv.ps1

@@ -80,6 +80,26 @@ try {
     Assert-MinLength $freshContent "CONFIG_INITIAL_ADMIN_PASSWORD" 12
     Assert-Value $freshContent "WS_AUTH_METHODS" "none,bearer,ws_ticket"
 
+    $freshRing = Get-EnvValue $freshContent 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING'
+    $freshId = Get-EnvValue $freshContent 'CONFIG_CREDENTIAL_ENCRYPTION_ACTIVE_KEY_ID'
+    $parsedRing = $freshRing | ConvertFrom-Json
+    if ([Convert]::FromBase64String($parsedRing.$freshId).Length -ne 32) { throw 'Invalid credential key length' }
+    Assert-Value $freshContent 'CONFIG_CREDENTIAL_ALLOW_LEGACY_PLAINTEXT' 'false'
+    Initialize-SecurityEnv -Path $fresh -Mode upgrade
+    if ((Get-EnvValue (Get-Content $fresh -Raw) 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING') -cne $freshRing) { throw 'Credential key must survive repeat upgrade' }
+    if (Get-EnvValue $upgradeContent 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING') { throw 'Existing deployment must not silently opt in' }
+    $env:DEPLOY_ENABLE_CREDENTIAL_ENCRYPTION = 'true'
+    Initialize-SecurityEnv -Path $upgrade -Mode upgrade
+    $env:DEPLOY_ENABLE_CREDENTIAL_ENCRYPTION = $null
+    $opted = Get-Content $upgrade -Raw
+    Assert-Value $opted 'CONFIG_CREDENTIAL_ALLOW_LEGACY_PLAINTEXT' 'true'
+    $before = Get-EnvValue $opted 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING'
+    Initialize-SecurityEnv -Path $upgrade -Mode upgrade
+    Assert-Value (Get-Content $upgrade -Raw) 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING' $before
+    $bad = Write-TestEnv 'bad.env' @('CONFIG_CREDENTIAL_ENCRYPTION_ACTIVE_KEY_ID=v1', 'CONFIG_CREDENTIAL_ENCRYPTION_KEYRING=')
+    $rejected = $false
+    try { Initialize-SecurityEnv -Path $bad -Mode upgrade } catch { $rejected = $true }
+    if (-not $rejected) { throw 'Partial key configuration must fail' }
     Write-Host "Security environment PowerShell tests passed" -ForegroundColor Green
 } finally {
     Remove-Item $tempDir -Recurse -Force -ErrorAction SilentlyContinue