docs: 完善部署与运维文档 (#107)

新增中英文升级恢复、安全加固、监控告警与故障排查手册，校正安装部署、CLI 与 API 参考，并修复安全密钥环境变量注入及其回归测试。

docs-site/docs/deployment/configuration.md

@@ -1,7 +1,7 @@
 ---
 sidebar_position: 4
 title: Configuration Reference
-description: All server.yaml configuration keys with defaults and matching environment variables.
+description: All config.yaml server keys with defaults and matching environment variables.
 ---
 
 # Configuration Reference
@@ -32,12 +32,15 @@ security:
 backup:
   temp_dir: "/tmp/backupx"    # BACKUPX_BACKUP_TEMP_DIR
   max_concurrent: 2           # BACKUPX_BACKUP_MAX_CONCURRENT
-  retries: 3                  # Per-upload rclone low-level retries
+  retries: 10                 # Per-upload rclone low-level retries
   bandwidth_limit: ""         # e.g. "10M" to cap transfers at 10 MB/s
 
 log:
   level: "info"               # debug | info | warn | error
   file: "./data/backupx.log"
+  max_size: 100               # MB per log file
+  max_backups: 3              # rotated files retained
+  max_age: 30                 # retention in days
 ```
 
 ## Secret generation
@@ -53,11 +56,17 @@ The environment wins when both file and env are set. All dot-paths become unders
 | `server.port` | `BACKUPX_SERVER_PORT` |
 | `server.external_url` | `BACKUPX_SERVER_EXTERNAL_URL` |
 | `server.trusted_proxies` | `BACKUPX_SERVER_TRUSTED_PROXIES` (comma-separated for env) |
+| `security.jwt_secret` | `BACKUPX_SECURITY_JWT_SECRET` |
 | `security.jwt_expire` | `BACKUPX_SECURITY_JWT_EXPIRE` |
+| `security.encryption_key` | `BACKUPX_SECURITY_ENCRYPTION_KEY` |
 | `log.level` | `BACKUPX_LOG_LEVEL` |
 | `backup.max_concurrent` | `BACKUPX_BACKUP_MAX_CONCURRENT` |
 | `backup.temp_dir` | `BACKUPX_BACKUP_TEMP_DIR` |
+| `backup.retries` | `BACKUPX_BACKUP_RETRIES` |
 | `backup.bandwidth_limit` | `BACKUPX_BACKUP_BANDWIDTH_LIMIT` |
+| `log.max_size` | `BACKUPX_LOG_MAX_SIZE` |
+| `log.max_backups` | `BACKUPX_LOG_MAX_BACKUPS` |
+| `log.max_age` | `BACKUPX_LOG_MAX_AGE` |
 
 ## Master external URL
 
@@ -70,7 +79,7 @@ server:
 
 This value is used when BackupX renders one-click Agent install scripts and docker-compose snippets. It must be reachable from every Agent host. Leave it empty only when `X-Forwarded-Proto` / `X-Forwarded-Host` are reliable and point to the same URL that Agents can access.
 
-The install wizard can set an Agent-specific runtime URL for a proxy or SSH-bastion node. The public install link continues to use `server.external_url`, while the generated Agent config uses that override.
+The install wizard can set an Agent-specific URL for a proxy or SSH-bastion node. That override is used by both the target-side one-time install URL and the generated Agent runtime configuration, while the browser continues to use the normal public address.
 
 ## Trusted reverse proxies
 
@@ -84,3 +93,5 @@ server:
 ```
 
 Do not configure `0.0.0.0/0`: client addresses feed authentication throttling, install-token throttling, and audit records. Set an empty list when BackupX is exposed directly and should trust no forwarded headers.
+
+Back up the complete data directory and configuration before changing security keys or database paths. See [Upgrade and Recovery](../operations/upgrade-recovery) for a tested snapshot and rollback sequence.