fix: remove hardcoded secrets from docker-compose.yml

.env.example

@@ -1,6 +1,9 @@
 # 数据库连接
 DATABASE_URL="postgresql://postgres:password@localhost:5432/maqt?schema=public"
 
+# PostgreSQL 密码（docker-compose 使用，请修改）
+POSTGRES_PASSWORD="your-postgres-password"
+
 # JWT 密钥（请修改为随机字符串）
 JWT_SECRET="your-super-secret-jwt-key-change-this-in-production"
 

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     container_name: maqt-postgres
     environment:
       POSTGRES_USER: maqt
-      POSTGRES_PASSWORD: maqt123456
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-maqt123456}
       POSTGRES_DB: maqt
     volumes:
       - pgdata:/var/lib/postgresql/data
@@ -25,9 +25,9 @@ services:
     ports:
       - "127.0.0.1:3002:3001"
     environment:
-      - DATABASE_URL=postgresql://maqt:maqt123456@postgres:5432/maqt
+      - DATABASE_URL=postgresql://maqt:${POSTGRES_PASSWORD:-maqt123456}@postgres:5432/maqt
-      - JWT_SECRET=maqt-jwt-secret-key-2026-change-in-production
+      - JWT_SECRET=${JWT_SECRET}
-      - ENCRYPTION_KEY=maqt-encryption-key-32bytes!
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
       - PORT=3001
     restart: unless-stopped
     depends_on: