refactor: mock清理+安全配置+通用组件+菜单优化

P0安全: SECRET_KEY/ADMIN_PASSWORD/CORS环境变量化, seed仅admin

P1Mock: mock.ts 301->88行, 删8数据mock+5generateMock, net-1300行

P2组件: useToast/useFetchList+ConfirmDialog/FormDialog

P3菜单: menuSections/menuItems->constants/menu.ts

P4API: NotificationsPage/WorkflowPage重写+RolesPage演示

测试: 1050passed, tsc clean

backend/app/main.py

@@ -29,23 +29,16 @@ async def seed_workflows():
 
 
 async def seed_data():
-    """Create default admin user and seed data."""
+    """Create default admin user from environment config."""
     async with async_session() as db:
         result = await db.execute(select(User).where(User.username == settings.ADMIN_USERNAME))
         if not result.scalar_one_or_none():
-            users = [
-                User(username="admin", display_name="管理员", role="admin",
-                     hashed_password=hash_password("123456")),
-                User(username="dba", display_name="DBA 张三", role="dba",
-                     hashed_password=hash_password("123456")),
-                User(username="dev1", display_name="开发者 李四", role="developer",
-                     hashed_password=hash_password("123456")),
-                User(username="dev2", display_name="开发者 王五", role="developer",
-                     hashed_password=hash_password("123456")),
-                User(username="auditor", display_name="审计员 赵六", role="developer",
-                     email="auditor@example.com", hashed_password=hash_password("123456")),
-            ]
-            db.add_all(users)
+            db.add(User(
+                username=settings.ADMIN_USERNAME,
+                display_name="管理员",
+                role="admin",
+                hashed_password=hash_password(settings.ADMIN_PASSWORD),
+            ))
             await db.commit()
 
 
@@ -85,9 +78,13 @@ app = FastAPI(
     docs_url="/docs" if settings.DEBUG else None,
 )
 
+# CORS: development allows *, production uses CORS_ORIGINS env var
+_cors_origins = ["*"] if settings.DEBUG else [
+    o.strip() for o in settings.CORS_ORIGINS.split(",") if o.strip()
+]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"] if settings.DEBUG else [],
+    allow_origins=_cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],