security: 安全审计修复 - API Key清理 + JWT改为HttpOnly Cookie

- API Key: run.md/.env/seed_model_providers.sql 中明文Key替换为占位符
- 认证: JWT从localStorage迁移到HttpOnly Cookie，移除后端body返回token
- 前端: api.ts/knowledge/page.tsx/auth.ts 全面改用Cookie认证
- postcss XSS: package.json添加overrides强制升级到8.5.15
- gitignore: 添加server/.env和.env排除规则
- lint: 移除tenant.go中未使用的roleKey常量
- 文档: 新增docs/security-audit-report.md和hardware-requirements.md

apps/web/src/app/(auth)/register/page.tsx

@@ -45,10 +45,9 @@ export default function RegisterPage() {
           email: string;
           role: "user" | "super_admin" | "admin" | "creator";
         };
-        access_token: string;
       }>("/api/v1/auth/register", { name, email, password });
 
-      setAuth(res.user, res.access_token);
+      setAuth(res.user);
       toast.success("注册成功");
       router.push("/store");
     } catch (err) {

apps/web/src/app/(portal)/knowledge/page.tsx

@@ -113,8 +113,8 @@ export default function KnowledgePage() {
       formData.append("file", file);
       const res = await fetch(`/api/v1/knowledge/${selectedKB!.id}/documents`, {
         method: "POST",
-        headers: { Authorization: `Bearer ${localStorage.getItem("token")}` },
         body: formData,
+        credentials: "include",
       });
       if (!res.ok) throw new Error("上传失败");
       return res.json();