feat(deploy): initialize authentication security secrets

start.sh

@@ -29,6 +29,7 @@ DEPLOY_IP="${DEPLOY_IP:-}"
 DEPLOY_DOMAIN="${DEPLOY_DOMAIN:-}"
 DEPLOY_HTTPS_ENV="${DEPLOY_HTTPS_INPUT:-${DEPLOY_HTTPS:-}}"
 DEPLOY_HTTPS=false
+SECURITY_ENV_MODE="upgrade"
 
 is_non_interactive() {
     [ "${DEPLOY_NON_INTERACTIVE:-0}" = "1" ] || [ "${CI:-}" = "true" ] || [ ! -t 0 ]
@@ -233,19 +234,27 @@ setup_env_files() {
     # 4/5. 配置 .env
     if [ ! -f .env ]; then
         cp .env.sample .env
+        SECURITY_ENV_MODE="new"
     fi
 
+    local web_port
+    web_port="$(awk -F= '$1 == "WEB_PORT" { print $2; exit }' .env | tr -d '[:space:]')"
+    web_port="${web_port:-3010}"
+
     if [ "$DEPLOY_MODE" = "ip" ]; then
         # IP 模式
         sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=http://${DEPLOY_IP}:3001|" .env
         sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=ws://${DEPLOY_IP}:3002|" .env
         sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=http://${DEPLOY_IP}:3003|" .env
+        sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=http://${DEPLOY_IP}:${web_port}|" .env
         echo "   ✓ .env 已配置为 IP 模式 (${DEPLOY_IP})"
     else
         # 域名模式
         sed -i.bak "s|^NUXT_PUBLIC_BASE_APIURL=.*|NUXT_PUBLIC_BASE_APIURL=/api|" .env
         sed -i.bak "s|^NUXT_PUBLIC_BASE_SOCKETURL=.*|NUXT_PUBLIC_BASE_SOCKETURL=wss://${DEPLOY_DOMAIN}/socket.io|" .env
         sed -i.bak "s|^NUXT_PUBLIC_SG_APIURL=.*|NUXT_PUBLIC_SG_APIURL=/asg-api|" .env
+        # 域名模式同时允许同域 HTTP/HTTPS，兼容首次签证书和复用既有证书两种流程。
+        sed -i.bak "s|^CONFIG_SECURITY_ORIGIN=.*|CONFIG_SECURITY_ORIGIN=https://${DEPLOY_DOMAIN},http://${DEPLOY_DOMAIN}|" .env
         echo "   ✓ .env 已配置为域名模式 (${DEPLOY_DOMAIN})"
 
         # 7. Nginx 配置（域名模式）
@@ -475,6 +484,12 @@ main() {
         fi
     fi
 
+    # 空值或历史默认值只在首次发现时生成并写回 .env，后续启动保持稳定。
+    # 数据库中的后台 JWT 轮转配置由后端优先使用，不受此处影响。
+    # shellcheck source=scripts/init-security-env.sh
+    . ./scripts/init-security-env.sh
+    init_security_env .env "$SECURITY_ENV_MODE"
+
     if [ "$DEPLOY_DRY_RUN" = "1" ]; then
         echo ""
         echo "⚠️  dry-run 模式：跳过 Docker 安装和服务启动"