feat(deploy): 自动初始化画布协作认证密钥

scripts/init-security-env.sh

@@ -81,6 +81,29 @@ ensure_security_secret() {
     echo "   ✓ 已初始化安全密钥: ${key}"
 }
 
+ensure_env_list_item() {
+    local file="$1"
+    local key="$2"
+    local required_item="$3"
+    local default_value="${4:-}"
+    local current normalized
+    current="$(read_env_value "$file" "$key")"
+    if [ -z "$current" ]; then
+        current="$default_value"
+    fi
+    normalized="$(printf '%s' "$current" | tr -d '[:space:]')"
+    case ",${normalized}," in
+        *",${required_item},"*) return 0 ;;
+    esac
+    if [ -n "$current" ]; then
+        current="${current},${required_item}"
+    else
+        current="$required_item"
+    fi
+    write_env_value "$file" "$key" "$current"
+    echo "   ✓ 已补充安全配置项: ${key}"
+}
+
 ensure_initial_admin_password() {
     local file="$1"
     local current
@@ -105,6 +128,8 @@ init_security_env() {
     fi
 
     ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret"
+    ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET"
+    ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer"
     if [ "$mode" = "new" ]; then
         ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"
         ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET"