feat: streamline platform and secure data access

- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces

.env.example

@@ -1,4 +1,10 @@
 # Database
+APP_ENVIRONMENT=development
+SECURITY_STRICT_MODE=false
+CORS_ALLOWED_ORIGINS=http://localhost:8102,http://127.0.0.1:8102
+TRUSTED_HOSTS=*
+SECURITY_HEADERS_ENABLED=true
+
 POSTGRES_USER=admin
 POSTGRES_PASSWORD=password
 POSTGRES_DB=kg_admin
@@ -6,6 +12,36 @@ DATABASE_URL=postgresql://admin:password@postgres:5432/kg_admin
 DB_SCHEMA=kg_admin_new2
 DB_MIGRATIONS_ENABLED=false
 
+# Data Center MySQL (independent from graph/system PostgreSQL)
+MYSQL_ROOT_PASSWORD=change-this-root-password
+MYSQL_DATABASE=platform_control
+MYSQL_USER=data_center
+MYSQL_PASSWORD=change-this-data-password
+DATA_MYSQL_URL=mysql://data_center:change-this-data-password@mysql:3306/platform_control
+DATA_MYSQL_REQUIRED=true
+DATA_MYSQL_POOL_MIN_SIZE=2
+DATA_MYSQL_POOL_MAX_SIZE=20
+DATA_SQL_CONSOLE_WRITE_ENABLED=false
+INTERFACE_API_SECRET=change-me-interface-api-secret
+DATA_MYSQL_DIRECT_ACCESS_ENABLED=false
+# Legacy fallback used by older deployments. Prefer DATA_MYSQL_SSH_HOST.
+DATA_MYSQL_PUBLIC_HOST=
+DATA_MYSQL_PUBLIC_PORT=0
+DATA_MYSQL_DIRECT_TRANSPORT=SSH 隧道（强制）
+DATA_MYSQL_SSH_TUNNEL_REQUIRED=true
+DATA_MYSQL_SSH_HOST=
+DATA_MYSQL_SSH_PORT=22
+DATA_MYSQL_SSH_AUTH_METHOD=SSH 私钥 / SSH Agent
+DATA_MYSQL_ADMIN_HOST=127.0.0.1
+DATA_MYSQL_ADMIN_PORT=3307
+DATA_MYSQL_ADMIN_ACCOUNT_POLICY=一人一号 · 单库授权 · 禁止 root
+DATA_MYSQL_AUDIT_ENABLED=false
+DATA_BACKUP_ENABLED=false
+DATA_BACKUP_ENCRYPTION_REQUIRED=true
+DATA_BACKUP_RETENTION_DAYS=30
+# 必须位于代码仓库之外，文件权限设为 600，内容至少 32 个随机字符。
+DATA_BACKUP_PASSPHRASE_FILE=/etc/travel-kg/secrets/mysql-backup-passphrase
+
 # FalkorDB
 FALKORDB_HOST=falkordb
 FALKORDB_INTERNAL_PORT=6379
@@ -16,9 +52,17 @@ FALKORDB_PASSWORD=
 # Auth
 AUTH_SECRET=change-me-32-chars-minimum-secret
 AUTH_ALGORITHM=HS256
-AUTH_TOKEN_EXPIRE_MINUTES=480
+AUTH_ISSUER=zn-kg-admin
+AUTH_AUDIENCE=zn-kg-admin-web
+AUTH_TOKEN_EXPIRE_MINUTES=60
 AUTH_DEFAULT_USERNAME=admin@example.com
 AUTH_DEFAULT_PASSWORD=change-me
+AUTH_LOGIN_MAX_ATTEMPTS=5
+AUTH_LOGIN_WINDOW_SECONDS=300
+AUTH_LOGIN_LOCK_SECONDS=900
+INTERFACE_API_DEFAULT_EXPIRY_DAYS=30
+INTERFACE_API_MAX_EXPIRY_DAYS=90
+INTERFACE_API_RATE_LIMIT_PER_MINUTE=120
 
 # LLM, optional
 LLM_PROVIDER=openai-compatible
@@ -54,6 +98,8 @@ API_HOST_BIND=0.0.0.0
 API_PORT=8102
 POSTGRES_HOST_BIND=127.0.0.1
 POSTGRES_PORT=5433
+MYSQL_HOST_BIND=127.0.0.1
+MYSQL_PORT=3307
 FALKORDB_HOST_BIND=127.0.0.1
 FALKORDB_PORT=6380
 FALKORDB_BROWSER_HOST_BIND=127.0.0.1