fix: harden uploads downloads and deployment config

backend/app/core/config.py

@@ -3,7 +3,7 @@ from typing import List
 
 class Settings(BaseSettings):
     # 项目信息
-    PROJECT_NAME: str = "爱设计 API"
+    PROJECT_NAME: str = "图绘 API"
     VERSION: str = "1.0.0"
     API_PREFIX: str = "/api"
     
@@ -12,7 +12,7 @@ class Settings(BaseSettings):
     # DATABASE_URL: str = "mysql+pymysql://root:password@localhost:3306/aishej"  # MySQL配置
     
     # JWT 配置
-    SECRET_KEY: str = "your-secret-key-change-this"
+    SECRET_KEY: str = "change-me-in-env"
     ALGORITHM: str = "HS256"
     ACCESS_TOKEN_EXPIRE_MINUTES: int = 1440  # 24小时
     
@@ -21,7 +21,7 @@ class Settings(BaseSettings):
     MAX_FILE_SIZE: int = 52428800  # 50MB
     
     # 水印配置
-    WATERMARK_TEXT: str = "爱设计 AiSheji.com"
+    WATERMARK_TEXT: str = "图绘 Tuhui.cloud"
     WATERMARK_OPACITY: int = 128
     
     # 缩略图配置
@@ -30,19 +30,18 @@ class Settings(BaseSettings):
     
     # CORS 配置（生产环境配置为具体域名）
     ALLOWED_ORIGINS: List[str] = [
-        "https://backend.huijie168.uk",
-        "https://app.huijie168.uk",
-        "https://run.huijie168.uk",
-        "https://huijie168.uk",
-        "https://www.huijie168.uk"
+        "https://tuhui.cloud",
+        "https://www.tuhui.cloud",
+        "http://localhost:5173",
+        "http://127.0.0.1:5173",
     ]
     
     # 易收米支付配置
-    YSM_APPID: str = "YSMcd16b45d"
-    YSM_APPSECRET: str = "899850e778e8d2b53e4c4a4e88695688"
-    YSM_NOTIFY_URL: str = "https://backend.huijie168.uk/api/payment/notify"  # 支付回调地址
-    YSM_CALLBACK_URL: str = "https://run.huijie168.uk/payment/success"  # 支付成功跳转地址
-    YSM_NOPAY_URL: str = "https://run.huijie168.uk/payment/cancel"  # 未支付跳转地址
+    YSM_APPID: str = ""
+    YSM_APPSECRET: str = ""
+    YSM_NOTIFY_URL: str = "https://tuhui.cloud/api/payment/notify"  # 支付回调地址
+    YSM_CALLBACK_URL: str = "https://tuhui.cloud/payment/success"  # 支付成功跳转地址
+    YSM_NOPAY_URL: str = "https://tuhui.cloud/payment/cancel"  # 未支付跳转地址
     
     class Config:
         env_file = ".env"