fix(deploy): 跨域来源未配置时默认放行

scripts/init-security-origin.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# 升级旧部署时补齐浏览器来源；显式配置始终保留并校验。
+# 浏览器来源为可选项：缺失或留空时保持宽松策略，显式配置时校验。
 # 不 source .env，避免执行环境文件中的内容。
 
 security_origin_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -23,27 +23,28 @@ init_security_origin() {
         return 1
     }
 
-    api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
-    public_url_validate "$api_url" || {
-        echo "❌ 请先配置有效的 CONFIG_PUBLIC_API_BASE_URL" >&2
-        return 1
-    }
-    scheme="${api_url%%://*}"
-    rest="${api_url#*://}"
-    authority="${rest%%/*}"
-    origin="${scheme}://${authority}"
-    security_origin_valid "$origin" || return 1
-
     current="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
-    if [ -z "$current" ] || {
-        [ "$current" = 'http://127.0.0.1,http://localhost' ] &&
-        [ "$origin" != 'http://127.0.0.1' ];
-    }; then
-        public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" "$origin"
-        echo "   ✓ 已配置浏览器来源: $origin"
+    if [ -z "$current" ]; then
+        echo "   ✓ 未配置浏览器来源，后端将默认允许所有来源"
         return 0
     fi
 
+    # 旧版样例值不是用户选择的白名单；非本机部署升级时清空，恢复缺省策略。
+    if [ "$current" = 'http://127.0.0.1,http://localhost' ]; then
+        api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
+        if public_url_validate "$api_url"; then
+            scheme="${api_url%%://*}"
+            rest="${api_url#*://}"
+            authority="${rest%%/*}"
+            origin="${scheme}://${authority}"
+            if [ "$origin" != 'http://127.0.0.1' ] && [ "$origin" != 'http://localhost' ]; then
+                public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" ""
+                echo "   ✓ 已清理历史浏览器来源样例值，后端将默认允许所有来源"
+                return 0
+            fi
+        fi
+    fi
+
     local -a origins
     case "$current" in
         ,*|*,|*,,*)