security: 敏感配置迁移至 appsettings.Secrets.json

- appsettings.json 敏感项（连接串/密钥/API Key）改为占位符
- 新增 appsettings.Secrets.json（本地，gitignore）+ .example.json（模板）
- Program.cs 与 3 个 design-time factory 加载 Secrets.json 覆盖
- 历史中的明文凭据已用 git filter-repo 清理（REDACTED）

.gitignore

@@ -21,6 +21,7 @@
 !.env.example
 **/appsettings.Development.json
 **/appsettings.Production.json
+**/appsettings.Secrets.json
 **/secrets.json
 
 # ===== 前端 =====

src/BuildFlow.Host/Program.cs

@@ -4,6 +4,10 @@ using OpenTelemetry.Logs;
 
 var builder = WebApplication.CreateBuilder(args);
 
+// 敏感配置（连接串/密钥）从本地 appsettings.Secrets.json 覆盖，该文件不入库（见 .gitignore）。
+// 不存在时 optional:true 静默跳过，回退到 appsettings.json 中的占位符。
+builder.Configuration.AddJsonFile("appsettings.Secrets.json", optional: true, reloadOnChange: true);
+
 // OTel 日志导出
 var otlpEndpoint = builder.Configuration["OpenTelemetry:OtlpEndpoint"] ?? "http://localhost:4316";
 builder.Logging.AddOpenTelemetry(logging =>

src/BuildFlow.Host/appsettings.Secrets.example.json

@@ -0,0 +1,23 @@
+{
+  "ConnectionStrings": {
+    "Default": "Host=YOUR_HOST;Port=15432;Username=rag;Password=YOUR_PG_PASSWORD",
+    "MongoDb": "mongodb://appuser:YOUR_MONGO_PASSWORD@YOUR_HOST:17017/im_system?authSource=app",
+    "Redis": "YOUR_HOST:16379,password=YOUR_REDIS_PASSWORD,abortConnect=false"
+  },
+  "RabbitMq": {
+    "Host": "YOUR_HOST",
+    "Username": "rag",
+    "Password": "YOUR_RABBITMQ_PASSWORD"
+  },
+  "S3": {
+    "Endpoint": "http://YOUR_HOST:39200",
+    "AccessKey": "YOUR_S3_ACCESS_KEY",
+    "SecretKey": "YOUR_S3_SECRET_KEY"
+  },
+  "Jwt": {
+    "SigningKey": "YOUR_SIGNING_KEY_AT_LEAST_32_CHARS_LONG"
+  },
+  "Ai": {
+    "ApiKey": "YOUR_AI_API_KEY"
+  }
+}

src/BuildFlow.Host/appsettings.json

@@ -18,9 +18,9 @@
   },
   "AllowedHosts": "*",
   "ConnectionStrings": {
-    "Default": "Host=43.134.235.58;Port=15432;Username=rag;Password=REDACTED_PG_PASSWORD",
-    "MongoDb": "mongodb://appuser:REDACTED_MONGO_PASSWORD@43.134.235.58:17017/im_system?authSource=app",
-    "Redis": "43.134.235.58:16379,password=REDACTED_REDIS_PASSWORD,abortConnect=false"
+    "Default": "Host=127.0.0.1;Port=15432;Username=rag;Password=REPLACE_IN_SECRETS",
+    "MongoDb": "mongodb://appuser:REPLACE_IN_SECRETS@127.0.0.1:17017/im_system?authSource=app",
+    "Redis": "127.0.0.1:16379,password=REPLACE_IN_SECRETS,abortConnect=false"
   },
   "DatabaseNames": {
     "Rag": "rag",
@@ -30,15 +30,15 @@
     "Platform": "platform"
   },
   "RabbitMq": {
-    "Host": "43.134.235.58",
+    "Host": "127.0.0.1",
     "Port": 25672,
     "Username": "rag",
-    "Password": "REDACTED_RABBITMQ_PASSWORD"
+    "Password": "REPLACE_IN_SECRETS"
   },
   "S3": {
-    "Endpoint": "http://43.134.235.58:39200",
-    "AccessKey": "REDACTED_S3_ACCESS",
-    "SecretKey": "REDACTED_S3_SECRET",
+    "Endpoint": "http://127.0.0.1:39200",
+    "AccessKey": "REPLACE_IN_SECRETS",
+    "SecretKey": "REPLACE_IN_SECRETS",
     "Region": "us-east-1"
   },
   "KkFileView": {
@@ -46,7 +46,7 @@
   },
   "Jwt": {
     "RequireHttps": false,
-    "SigningKey": "REDACTED_JWT_SIGNING_KEY_MIN_32_CHARS!!",
+    "SigningKey": "REPLACE_IN_SECRETS_MIN_32_CHARS",
     "Issuer": "http://localhost:5211",
     "Audience": "rag-frontend",
     "AccessTokenMinutes": 240,
@@ -64,7 +64,7 @@
   },
   "Ai": {
     "BaseUrl": "http://localhost:1234/v1",
-    "ApiKey": "lm-studio",
+    "ApiKey": "REPLACE_IN_SECRETS",
     "ChatModel": "qwen/qwen3.6-27b",
     "EmbeddingModel": "text-embedding-embeddinggemma-300m",
     "DefaultInstructions": "你是 BuildFlow AI 助手。普通对话直接回答；当消息明确包含知识库上下文时，优先基于上下文回答。不要输出“作为RAG知识库助手”等身份开场、Markdown标题或推理过程；不要因为普通对话没有上下文就要求用户补充资料。",

src/modules/file/Infrastructure/Persistence/FileDbContextDesignTimeFactory.cs

@@ -36,6 +36,7 @@ public class FileDbContextDesignTimeFactory : IDesignTimeDbContextFactory<FileDb
         var config = new ConfigurationBuilder()
             .SetBasePath(appsettingsPath ?? ".")
             .AddJsonFile("appsettings.json", optional: false)
+            .AddJsonFile("appsettings.Secrets.json", optional: true)
             .Build();
 
         // 优先读 "File" 键（BuildFlow Host 用），否则回退 "Default"

src/modules/im/Infrastructure/Persistence/ImDbContextDesignTimeFactory.cs

@@ -36,6 +36,7 @@ public class ImDbContextDesignTimeFactory : IDesignTimeDbContextFactory<ImDbCont
         var config = new ConfigurationBuilder()
             .SetBasePath(appsettingsPath ?? ".")
             .AddJsonFile("appsettings.json", optional: false)
+            .AddJsonFile("appsettings.Secrets.json", optional: true)
             .Build();
 
         // 优先读 "Im" 键（BuildFlow Host 用），否则回退 "Default"

src/modules/rag/Infrastructure/Persistence/RagDbContextDesignTimeFactory.cs

@@ -31,6 +31,7 @@ public class RagDbContextDesignTimeFactory : IDesignTimeDbContextFactory<RagDbCo
         var config = new ConfigurationBuilder()
             .SetBasePath(hostProjectPath)
             .AddJsonFile("appsettings.json", optional: false)
+            .AddJsonFile("appsettings.Secrets.json", optional: true)
             .Build();
 
         // 与 Host 运行时一致：Default 连接串 + DatabaseNames:Rag 拼接库名