docs: 完善部署与运维文档 (#107)

新增中英文升级恢复、安全加固、监控告警与故障排查手册，校正安装部署、CLI 与 API 参考，并修复安全密钥环境变量注入及其回归测试。

server/internal/config/config.go

@@ -169,7 +169,9 @@ func applyDefaults(v *viper.Viper) {
 	v.SetDefault("server.trusted_proxies", []string{"127.0.0.1", "::1"})
 	v.SetDefault("server.web_root", "")
 	v.SetDefault("database.path", "./data/backupx.db")
+	v.SetDefault("security.jwt_secret", "")
 	v.SetDefault("security.jwt_expire", "24h")
+	v.SetDefault("security.encryption_key", "")
 	v.SetDefault("backup.temp_dir", "/tmp/backupx")
 	v.SetDefault("backup.max_concurrent", 2)
 	v.SetDefault("backup.retries", 10)

server/internal/config/config_test.go

@@ -72,6 +72,22 @@ func TestLoadReadsServerExternalURLFromEnv(t *testing.T) {
 	}
 }
 
+func TestLoadReadsSecuritySecretsFromEnv(t *testing.T) {
+	t.Setenv("BACKUPX_SECURITY_JWT_SECRET", "test-jwt-secret")
+	t.Setenv("BACKUPX_SECURITY_ENCRYPTION_KEY", "test-encryption-key")
+
+	cfg, err := Load("")
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	if cfg.Security.JWTSecret != "test-jwt-secret" {
+		t.Fatalf("expected JWT secret from env, got %q", cfg.Security.JWTSecret)
+	}
+	if cfg.Security.EncryptionKey != "test-encryption-key" {
+		t.Fatalf("expected encryption key from env, got %q", cfg.Security.EncryptionKey)
+	}
+}
+
 func TestLoadReadsTrustedProxiesFromEnv(t *testing.T) {
 	t.Setenv("BACKUPX_SERVER_TRUSTED_PROXIES", "127.0.0.1,172.18.0.0/16")
 	cfg, err := Load("")