feat: harden data access and simplify user management

.env.example

@@ -17,28 +17,48 @@ MYSQL_ROOT_PASSWORD=change-this-root-password
 MYSQL_DATABASE=platform_control
 MYSQL_USER=data_center
 MYSQL_PASSWORD=change-this-data-password
+MYSQL_ACCESS_BROKER_USER=access_broker
+MYSQL_ACCESS_BROKER_PASSWORD=change-this-access-broker-credential
 DATA_MYSQL_URL=mysql://data_center:change-this-data-password@mysql:3306/platform_control
 DATA_MYSQL_REQUIRED=true
 DATA_MYSQL_POOL_MIN_SIZE=2
 DATA_MYSQL_POOL_MAX_SIZE=20
 DATA_SQL_CONSOLE_WRITE_ENABLED=false
 INTERFACE_API_SECRET=change-me-interface-api-secret
-DATA_MYSQL_DIRECT_ACCESS_ENABLED=false
+DATA_MYSQL_DIRECT_ACCESS_ENABLED=true
 # Legacy fallback used by older deployments. Prefer DATA_MYSQL_SSH_HOST.
 DATA_MYSQL_PUBLIC_HOST=
 DATA_MYSQL_PUBLIC_PORT=0
 DATA_MYSQL_DIRECT_TRANSPORT=SSH 隧道（强制）
 DATA_MYSQL_SSH_TUNNEL_REQUIRED=true
 DATA_MYSQL_SSH_HOST=
-DATA_MYSQL_SSH_PORT=22
+DATA_MYSQL_SSH_PORT=2222
+DATA_MYSQL_SSH_BIND=127.0.0.1
+DATA_MYSQL_SSH_USERNAME=dbeaver
 DATA_MYSQL_SSH_AUTH_METHOD=SSH 私钥 / SSH Agent
+DATA_MYSQL_MANAGED_ACCESS_ENABLED=true
+DATA_MYSQL_SSH_AUTHORIZED_KEYS_FILE=/var/lib/travel-kg/dbeaver-access/authorized_keys
+DATA_MYSQL_SSH_HOST_PUBLIC_KEY_FILE=/var/lib/travel-kg/dbeaver-access/ssh_host_ed25519_key.pub
+DATA_MYSQL_PROVISIONER_USER=access_broker
+DATA_MYSQL_PROVISIONER_PASSWORD=change-this-access-broker-credential
 DATA_MYSQL_ADMIN_HOST=127.0.0.1
 DATA_MYSQL_ADMIN_PORT=3307
 DATA_MYSQL_ADMIN_ACCOUNT_POLICY=一人一号 · 单库授权 · 禁止 root
 DATA_MYSQL_AUDIT_ENABLED=false
+# 开发环境继续使用 Docker named volume。生产服务器覆盖文件强制改为独立块存储：
+DATA_MYSQL_STORAGE_BACKEND=docker-volume
+# 生产示例：/mnt/sdr、prod-mysql-storage-01、/mnt/sdr/nianxx/mysql
+MYSQL_STORAGE_MOUNT=
+MYSQL_STORAGE_ID=
+MYSQL_DATA_DIR=
+# mysql:8.4 官方镜像默认用户；更换镜像时先核对 UID/GID。
+MYSQL_CONTAINER_UID=999
+MYSQL_CONTAINER_GID=999
 DATA_BACKUP_ENABLED=false
 DATA_BACKUP_ENCRYPTION_REQUIRED=true
 DATA_BACKUP_RETENTION_DAYS=30
+# 生产必须是代码仓库和 MySQL 运行目录之外的现有目录。
+DATA_BACKUP_ROOT=
 # 必须位于代码仓库之外，文件权限设为 600，内容至少 32 个随机字符。
 DATA_BACKUP_PASSPHRASE_FILE=/etc/travel-kg/secrets/mysql-backup-passphrase