security: 安全审计修复 - API Key清理 + JWT改为HttpOnly Cookie

- API Key: run.md/.env/seed_model_providers.sql 中明文Key替换为占位符
- 认证: JWT从localStorage迁移到HttpOnly Cookie，移除后端body返回token
- 前端: api.ts/knowledge/page.tsx/auth.ts 全面改用Cookie认证
- postcss XSS: package.json添加overrides强制升级到8.5.15
- gitignore: 添加server/.env和.env排除规则
- lint: 移除tenant.go中未使用的roleKey常量
- 文档: 新增docs/security-audit-report.md和hardware-requirements.md

server/migrations/seed_model_providers.sql

@@ -13,7 +13,7 @@ INSERT INTO model_providers (
     gen_random_uuid(),
     '阿里云百炼 (通义千问)',
     'https://dashscope.aliyuncs.com/compatible-mode/v1',
-    'sk-c0c5174892c44ff48d587cd040fbdd40',  -- 实际环境中应该加密存储
+    '[YOUR_API_KEY]',  -- 部署时通过环境变量 OPENAI_API_KEY 注入
     '[
         {"id": "qwen-plus", "name": "通义千问-Plus", "type": "chat"},
         {"id": "qwen-turbo", "name": "通义千问-Turbo", "type": "chat"},