chore: 统一本地服务器与远程仓库源码

- 合并 main 与 master 历史并以服务器结构为基线
- 保留迁移、数据保留、AWS 账单与部署安全能力
- 建立 SDD 规格和 CI 验证闭环

docker-compose.yml

@@ -10,13 +10,13 @@ services:
     hostname: aiops-mysql
     restart: unless-stopped
     environment:
-      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-CHANGE_ME}
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?请在 .env 设置 MYSQL_ROOT_PASSWORD}
       MYSQL_DATABASE: ${MYSQL_DATABASE:-aiops}
       MYSQL_USER: ${MYSQL_USER:-aiops}
-      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-CHANGE_ME}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?请在 .env 设置 MYSQL_PASSWORD}
       TZ: Asia/Shanghai
     ports:
-      - "3306:3306"
+      - "127.0.0.1:3306:3306"
     volumes:
       - mysql_data:/var/lib/mysql
     command: >
@@ -40,7 +40,7 @@ services:
     hostname: aiops-redis
     restart: unless-stopped
     ports:
-      - "6379:6379"
+      - "127.0.0.1:6379:6379"
     volumes:
       - redis_data:/data
     command: redis-server --appendonly yes
@@ -79,18 +79,22 @@ services:
       DATABASE_HOST: mysql
       DATABASE_PORT: 3306
       DATABASE_USER: ${MYSQL_USER:-aiops}
-      DATABASE_PASSWORD: ${MYSQL_PASSWORD:-CHANGE_ME}
+      DATABASE_PASSWORD: ${MYSQL_PASSWORD:?请在 .env 设置 MYSQL_PASSWORD}
       DATABASE_DBNAME: ${MYSQL_DATABASE:-aiops}
       REDIS_DRIVER: redis
       REDIS_HOST: redis
       REDIS_PORT: 6379
-      JWT_SECRET: ${JWT_SECRET:-aiops-jwt-secret-change-me}
+      JWT_SECRET: ${JWT_SECRET:?请在 .env 设置 JWT_SECRET}
       # RDP 使用自研协议栈，第三方 grdp 已移除；该变量保留兼容但后端不再读取。 // Logan.Li
       RDP_ENGINE: ${RDP_ENGINE:-rdp}
       RDP_DEBUG: ${RDP_DEBUG:-1}
     volumes:
       - aiops_uploads:/app/uploads
-      - /var/run/docker.sock:/var/run/docker.sock
+    # 禁止挂载 Docker Socket；容器控制应使用受限远端 API 或专用执行器。 // Logan.Li
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
     depends_on:
       mysql:
         condition: service_healthy