chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook

- Delete backups/*.dump and all real credentials from README/docs
  (prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
  docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
  + systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist

infra/deploy-webhook/erp-deploy-webhook.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=ERP push-to-deploy webhook receiver (Gitea -> docker compose)
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+# Run as a dedicated non-root user with docker group membership:
+#   sudo useradd -r -s /usr/sbin/nologin erpdeploy && sudo usermod -aG docker erpdeploy
+#   sudo chown -R erpdeploy /srv/erp
+User=erpdeploy
+Group=erpdeploy
+WorkingDirectory=/srv/erp
+# EnvironmentFile carries GITEA_WEBHOOK_SECRET (same .env used by compose).
+EnvironmentFile=/srv/erp/.env
+ExecStart=/usr/bin/python3 /srv/erp/infra/deploy-webhook/deploy_webhook.py
+Restart=on-failure
+RestartSec=5
+# Minimal exposure: no write access outside /srv/erp, no new privileges.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/srv/erp /tmp
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target