feat: streamline platform and secure data access

- move the relational data center to MySQL and a standalone workbench\n- add Interface Center API credentials, policies, logs, and DBeaver SSH guidance\n- harden authentication and deployment while retiring unused management surfaces

docker-compose.server.yml

@@ -1,9 +1,34 @@
 services:
+  postgres:
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:?必须设置 POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?必须设置 POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:?必须设置 POSTGRES_DB}
+
+  mysql:
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?必须设置 MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-platform_control}
+      MYSQL_USER: ${MYSQL_USER:?必须设置 MYSQL_USER}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?必须设置 MYSQL_PASSWORD}
+
   api:
     network_mode: host
     ports: !override []
     environment:
-      DATABASE_URL: postgresql://${POSTGRES_USER:-admin}:${POSTGRES_PASSWORD:-password}@127.0.0.1:${POSTGRES_PORT:-5433}/${POSTGRES_DB:-kg_admin}
+      APP_ENVIRONMENT: production
+      SECURITY_STRICT_MODE: "true"
+      DATABASE_URL: postgresql://${POSTGRES_USER:?必须设置 POSTGRES_USER}:${POSTGRES_PASSWORD:?必须设置 POSTGRES_PASSWORD}@127.0.0.1:${POSTGRES_PORT:-5433}/${POSTGRES_DB:?必须设置 POSTGRES_DB}
+      DATA_MYSQL_URL: mysql://${MYSQL_USER:?必须设置 MYSQL_USER}:${MYSQL_PASSWORD:?必须设置 MYSQL_PASSWORD}@127.0.0.1:${MYSQL_PORT:-3307}/${MYSQL_DATABASE:-platform_control}
+      AUTH_SECRET: ${AUTH_SECRET:?必须设置至少 32 位 AUTH_SECRET}
+      AUTH_DEFAULT_PASSWORD: ${AUTH_DEFAULT_PASSWORD:?必须设置至少 12 位管理员密码}
+      INTERFACE_API_SECRET: ${INTERFACE_API_SECRET:?必须设置独立的 INTERFACE_API_SECRET}
+      INGEST_API_KEYS: ${INGEST_API_KEYS:?必须设置外部接口密钥}
+      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:?必须设置后台 HTTPS 来源}
+      TRUSTED_HOSTS: ${TRUSTED_HOSTS:?必须设置服务器域名}
+      MYSQL_HOST_BIND: 127.0.0.1
+      DATA_MYSQL_SSH_TUNNEL_REQUIRED: "true"
+      DATA_SQL_CONSOLE_WRITE_ENABLED: "false"
       FALKORDB_HOST: 127.0.0.1
       FALKORDB_PORT: ${FALKORDB_PORT:-6380}
     command:
@@ -12,7 +37,7 @@ services:
       - uvicorn
       - app.main:app
       - --host
-      - 0.0.0.0
+      - ${API_BIND_HOST:-127.0.0.1}
       - --port
       - ${API_PORT:-8102}
     healthcheck: