chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook

- Delete backups/*.dump and all real credentials from README/docs
  (prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
  docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
  + systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist

.gitignore

@@ -11,9 +11,19 @@ __pycache__/
 venv/
 
 # ---- Env / secrets ----
+# All credentials live in git-ignored .env files (server-side and local).
+# NEVER commit .env or database dumps — see docs/SECRET-MANAGEMENT.md.
+.env
+.env.*
+!*.env.example
+backend/.env
 frontend/.env
 *.local
 
+# ---- Database dumps (contain user rows + signing material) ----
+*.dump
+*.sql.gz
+
 # ---- Local session / backups ----
 .zcode/
 v1.2 - Copy/