security: 安全审计修复 - API Key清理 + JWT改为HttpOnly Cookie

- API Key: run.md/.env/seed_model_providers.sql 中明文Key替换为占位符
- 认证: JWT从localStorage迁移到HttpOnly Cookie，移除后端body返回token
- 前端: api.ts/knowledge/page.tsx/auth.ts 全面改用Cookie认证
- postcss XSS: package.json添加overrides强制升级到8.5.15
- gitignore: 添加server/.env和.env排除规则
- lint: 移除tenant.go中未使用的roleKey常量
- 文档: 新增docs/security-audit-report.md和hardware-requirements.md

server/internal/handler/auth.go

@@ -108,8 +108,8 @@ func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) {
 		"user": userResponse{
 			ID: id.String(), Name: req.Name, Email: req.Email, Role: "user",
 		},
-		"access_token": tokenPair.AccessToken,
-		"expires_at":   tokenPair.ExpiresAt,
+		// access_token 已通过 HttpOnly Cookie 设置，不再在 body 中返回
+		"expires_at": tokenPair.ExpiresAt,
 	})
 }
 
@@ -205,9 +205,8 @@ func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
 	}
 
 	response.JSON(w, http.StatusOK, map[string]any{
-		"user":         usr,
-		"access_token": tokenPair.AccessToken,
-		"expires_at":   tokenPair.ExpiresAt,
+		"user":       usr,
+		"expires_at": tokenPair.ExpiresAt,
 	})
 }
 
@@ -316,8 +315,8 @@ func (h *AuthHandler) SwitchOrg(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// 为目标用户生成新的JWT token
-	tokens, err := h.jwtMgr.GenerateTokenPair(targetID, targetEmail, targetRole)
+	// 为目标用户生成新的JWT token（通过 HttpOnly Cookie 设置）
+	_, err = h.jwtMgr.GenerateTokenPair(targetID, targetEmail, targetRole)
 	if err != nil {
 		response.InternalError(w, "生成令牌失败")
 		return
@@ -327,7 +326,7 @@ func (h *AuthHandler) SwitchOrg(w http.ResponseWriter, r *http.Request) {
 	response.JSON(w, http.StatusOK, map[string]any{
 		"message": "已切换",
 		"org":     org,
-		"token":   tokens.AccessToken,
+		// access_token 已通过 HttpOnly Cookie 设置
 		"user": map[string]any{
 			"id":     targetID,
 			"name":   targetName,
@@ -412,7 +411,6 @@ func (h *AuthHandler) Refresh(w http.ResponseWriter, r *http.Request) {
 	})
 
 	response.JSON(w, http.StatusOK, map[string]any{
-		"access_token": tokenPair.AccessToken,
-		"expires_at":   tokenPair.ExpiresAt,
+		"expires_at": tokenPair.ExpiresAt,
 	})
 }